Nod32 - wirus w pliku dmserver.dll

**Posty:** 56 · przez **LOko "noob"** 27 Paź 2008, 18:55

Witam

Ostatnio po aktualizacji NOD32 wykrył takie zagrożenie:

Win32/Patched.BU wirus

Zagrożenie znajduje się pod taką lokalizacją:

c:\windows\system32\dmserver.dll

Nie da się wyleczyć pliku.
Czy mogę ten plik bezpiecznie usunąć?? Za co jest odpowiedzialny?? Co to za wirus???

Pozdrawiam

**Posty:** 18165 · przez **wojtas** 27 Paź 2008, 19:09

przesaknuj tu ten plik

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow

**Posty:** 56 · przez **LOko "noob"** 27 Paź 2008, 19:17

Chyba nie da rady go wysłać, bo cały czas uaktywnia on Noda:

The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file

0 bytes size received / Se ha recibido un archivo vacio

**Posty:** 7956 · przez **Magik** 27 Paź 2008, 20:06

LOko "noob" napisał(a):Chyba nie da rady go wysłać, bo cały czas uaktywnia on Noda:

to tzreba bylo na chwile wylaczyc monitor NoD'a

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 56 · przez **LOko "noob"** 27 Paź 2008, 22:12

Chwilowo wyłączyłem monitor Noda, a oto rezultaty:

Kod: Zaznacz wszystko: Scan taken on 27 Oct 2008 20:07:16 (GMT) A-Squared Found nothing AntiVir Found TR/Patched.BU.44 ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found Trojan.Patched.BU ClamAV Found nothing CPsecure Found nothing Dr.Web Found Trojan.Starter.544 F-Prot Antivirus Found W32/Patched.F.gen!Eldorado F-Secure Anti-Virus Found nothing G DATA Found Trojan.Patched.BU Ikarus Found Packer.Malware.NSAnti.H Kaspersky Anti-Virus Found nothing NOD32 Found Win32/Patched.BU Norman Virus Control Found nothing Panda Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing

Kod: Zaznacz wszystko: Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 2008.10.27.3 2008.10.27 - AntiVir 7.9.0.9 2008.10.27 TR/Patched.BU.44 Authentium 5.1.0.4 2008.10.27 - Avast 4.8.1248.0 2008.10.27 - AVG 8.0.0.161 2008.10.27 Win32/PEPatch BitDefender 7.2 2008.10.27 Trojan.Patched.BU CAT-QuickHeal 9.50 2008.10.27 - ClamAV 0.93.1 2008.10.27 - DrWeb 4.44.0.09170 2008.10.27 Trojan.Starter.544 eSafe 7.0.17.0 2008.10.27 - eTrust-Vet 31.6.6168 2008.10.25 - Ewido 4.0 2008.10.27 - F-Prot 4.4.4.56 2008.10.27 W32/Patched.F.gen!Eldorado F-Secure 8.0.14332.0 2008.10.27 - Fortinet 3.113.0.0 2008.10.27 W32/Starter.DLL!tr GData 19 2008.10.27 Trojan.Patched.BU Ikarus T3.1.1.44.0 2008.10.27 Packer.Malware.NSAnti.H K7AntiVirus 7.10.509 2008.10.27 - Kaspersky 7.0.0.125 2008.10.27 - McAfee 5415 2008.10.25 W32/DMSPatch Microsoft 1.4005 2008.10.27 Virus:Win32/Dmspatch.A NOD32 3560 2008.10.27 Win32/Patched.BU Norman 5.80.02 2008.10.27 - Panda 9.0.0.4 2008.10.27 - PCTools 4.4.2.0 2008.10.27 - Prevx1 V2 2008.10.27 - Rising 21.01.02.00 2008.10.27 Trojan.Win32.Loader.d SecureWeb-Gateway 6.7.6 2008.10.27 Trojan.Patched.BU.44 Sophos 4.35.0 2008.10.27 - Sunbelt 3.1.1753.1 2008.10.25 - Symantec 10 2008.10.27 - TheHacker 6.3.1.1.131 2008.10.27 - TrendMicro 8.700.0.1004 2008.10.27 PE_PEPATCH.JY VBA32 3.12.8.8 2008.10.27 - ViRobot 2008.10.27.1438 2008.10.27 - VirusBuster 4.5.11.0 2008.10.27 - Dodatkowe informacje File size: 24064 bytes MD5...: 55424d708dac686a0a2dea6c5e064202 SHA1..: 0055c1a231ef37471f5857c6918e6249e92be16e SHA256: b73b301a297340bb2cbe82ece713daba00ffa0a5bcb41dc58348c7715706f0ec SHA512: 59e856e6fd6506559421facfd49e8bea7118f7d01ae8fb0da8fada37cea02d55 7a1c599369b6678bb80c8d1bf7aa0dc74671a82228512d772979f67b9687a6cd PEiD..: - TrID..: File type identification Win32 Executable Generic (42.3%) Win32 Dynamic Link Library (generic) (37.6%) Generic Win/DOS Executable (9.9%) DOS Executable Generic (9.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x74f41121 timedatestamp.....: 0x41109397 (Wed Aug 04 07:43:19 2004) machinetype.......: 0x14c (I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x3d35 0x3e00 6.30 10905fa05c698200a8cfaa1b225fe0a3 .data 0x5000 0x40 0x200 0.12 f6a079134b151e22b7945e3c260d0325 .rsrc 0x6000 0x1510 0x1600 3.88 31b94ec2dad42bae70fe5c374667e55e .reloc 0x8000 0x2f8 0x400 5.56 ce847536faea95f9f6d42dee2e8bc941 ( 7 imports ) > msvcrt.dll: wcscmp, _except_handler3, wcslen, malloc, __3@YAXPAX@Z, vsprintf, free, __2@YAPAXI@Z, wcscpy > ntdll.dll: NtDeviceIoControlFile, NtOpenFile, RtlInitUnicodeString, DbgPrintEx, NtOpenEvent, NtClose, VerSetConditionMask > KERNEL32.dll: SetUnhandledExceptionFilter, CloseHandle, CreateFileW, SetErrorMode, GetLastError, VerifyVersionInfoW, SetLastError, SetEvent, UnregisterWait, RegisterWaitForSingleObject, WaitForSingleObject, CreateEventW, OutputDebugStringW, DisableThreadLibraryCalls, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess > ADVAPI32.dll: StartServiceW, SetServiceStatus, ReportEventW, RegCloseKey, OpenSCManagerW, OpenServiceW, CloseServiceHandle, QueryServiceStatus, DeregisterEventSource, RegSetValueExW, RegisterEventSourceW, RegisterServiceCtrlHandlerExW, RegOpenKeyExW, RegQueryValueExW > USER32.dll: UnregisterDeviceNotification, RegisterDeviceNotificationW, wsprintfW > RPCRT4.dll: NdrClientCall2, RpcBindingFromStringBindingW, RpcStringBindingComposeW, RpcBindingFree, RpcStringFreeW > SETUPAPI.dll: SetupDiEnumDeviceInterfaces, SetupDiGetDeviceInterfaceDetailW, SetupDiGetClassDevsW, SetupDiDestroyDeviceInfoList ( 1 exports ) ServiceMain

Mogę usunąć go NOD'em??? (Mam taką opcję gdy próbuję otworzyć ten plik)

**Posty:** 7956 · przez **Magik** 27 Paź 2008, 22:49

LOko "noob" napisał(a):Mogę usunąć go NOD'em??? (Mam taką opcję gdy próbuję otworzyć ten plik)

mozesz

do tego gdzie sa te logi, ktore miales wkleic??

**Posty:** 56 · przez **LOko "noob"** 27 Paź 2008, 23:24

już wklejam:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.238 [/b] Run by Administrator on 2008-10-27 at 22:07 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-27 22:11:00 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40] "khjeh"=hex:20,02,00,00,b6,76,7f,2a,25,c1,34,9a,92,56,30,66,b1,07,09,76,90,.. "hj34z0"=hex:5d,bc,d5,17,2d,0a,26,12,dd,5b,1e,02,02,c9,22,c8,c2,41,d9,40,b4,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf41] "khjeh"=hex:20,02,00,00,83,4e,7a,47,e7,dc,57,ea,8e,fb,cb,2c,19,12,9a,3b,48,.. "hj34z0"=hex:7c,b3,db,2d,38,ad,47,71,66,59,38,99,57,43,b1,a9,f5,b9,37,2c,d4,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:7f,19,7c,76,4c,8c,af,4f,b4,d4,4c,ee,da,a9,b0,04,de,8a,7a,27,da,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "khjeh"=hex:de,17,db,ba,53,3f,a9,76,01,6e,8b,bf,8b,f6,fd,e6,1b,19,9d,81,da,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:f3,15,bd,e5,cd,88,17,02,0d,98,3f,46,c3,78,b5,93,6c,38,85,f0,93,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:7f,19,7c,76,4c,8c,af,4f,b4,d4,4c,ee,da,a9,b0,04,de,8a,7a,27,da,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "khjeh"=hex:de,17,db,ba,53,3f,a9,76,01,6e,8b,bf,8b,f6,fd,e6,1b,19,9d,81,da,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:f3,15,bd,e5,cd,88,17,02,0d,98,3f,46,c3,78,b5,93,6c,38,85,f0,93,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny" "D:\\Program Files\\AA\\System\\ArmyOps.exe"="D:\\Program Files\\AA\\System\\ArmyOps.exe:*:Enabled:ArmyOps" "D:\\Program Files\\AA\\System\\Server.exe"="D:\\Program Files\\AA\\System\\Server.exe:*:Enabled:Server" "C:\\Program Files\\FlashGet\\flashget.exe"="C:\\Program Files\\FlashGet\\flashget.exe:*:Enabled:Flashget" "C:\\Program Files\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare\\BearShare.exe:*:Enabled:BearShare" "D:\\Program Files\\EA GAMES\\Battlefield 1942\\BF1942.exe"="D:\\Program Files\\EA GAMES\\Battlefield 1942\\BF1942.exe:*:Enabled:BF1942" "C:\\WINDOWS\\system32\\dpnsvr.exe"="C:\\WINDOWS\\system32\\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server" "D:\\Program Files\\Day of Defeat Source\\hl2.exe"="D:\\Program Files\\Day of Defeat Source\\hl2.exe:*:Enabled:hl2" "E:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"="E:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe:*:Enabled:CoD2MP_s" "E:\\Program Files\\MotoGP URT 3\\motogp.exe"="E:\\Program Files\\MotoGP URT 3\\motogp.exe:*:Enabled:motogp" "C:\\Program Files\\BitComet\\BitComet.exe"="C:\\Program Files\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent" "D:\\PC_Pacific Fighters (ubisoft) -standalone-.direct.play.-ToeD\\UbiSoft\\PacificFighter\\pf.exe"="D:\\PC_Pacific Fighters (ubisoft) -standalone-.direct.play.-ToeD\\UbiSoft\\PacificFighter\\pf.exe:*:Enabled:pf" "D:\\Program Files\\UbiSoft\\PacificFighter\\pf.exe"="D:\\Program Files\\UbiSoft\\PacificFighter\\pf.exe:*:Enabled:pf" "C:\\Program Files\\GameSpy Arcade\\Aphex.exe"="C:\\Program Files\\GameSpy Arcade\\Aphex.exe:*:Enabled:GameSpy Arcade" "D:\\Program Files\\Hidden and Dangerous 2 Sabre Squadron\\HD2_SabreSquadron.exe"="D:\\Program Files\\Hidden and Dangerous 2 Sabre Squadron\\HD2_SabreSquadron.exe:*:Enabled:HD2_SabreSquadron" "D:\\Program Files\\Hidden and Dangerous 2 Sabre Squadron\\ServerLauncher.exe"="D:\\Program Files\\Hidden and Dangerous 2 Sabre Squadron\\ServerLauncher.exe:*:Enabled:ServerLauncher" "D:\\Program Files\\Hidden and Dangerous 2 Sabre Squadron\\HD2DS_SabreSquadron.exe"="D:\\Program Files\\Hidden and Dangerous 2 Sabre Squadron\\HD2DS_SabreSquadron.exe:*:Enabled:HD2DS_SabreSquadron" "C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test" "D:\\Program Files\\Hidden and Dangerous 2 Sabre Squadron\\setup.exe"="D:\\Program Files\\Hidden and Dangerous 2 Sabre Squadron\\setup.exe:*:Enabled:setup" "D:\\Program Files\\Illusion Softworks\\Hidden and Dangerous 2 Sabre Squadron\\HD2_SabreSquadron.exe"="D:\\Program Files\\Illusion Softworks\\Hidden and Dangerous 2 Sabre Squadron\\HD2_SabreSquadron.exe:*:Disabled:HD2_SabreSquadron" "D:\\Program Files\\Illusion Softworks\\Hidden & Dangerous 2\\hd2.exe"="D:\\Program Files\\Illusion Softworks\\Hidden & Dangerous 2\\hd2.exe:*:Enabled:hd2" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Disabled:hpfccopy.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Disabled:hpoews01.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Disabled:hpofxm08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Disabled:hposfx08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Disabled:hposid01.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Disabled:hpqcopy.exe" "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Disabled:hpqdia.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Disabled:hpqkygrp.exe" "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Disabled:hpqphunl.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Disabled:hpqscnvw.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Disabled:hpqste08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Disabled:hpqtra08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Disabled:hpzwiz01.exe" "C:\\Documents and Settings\\Admin\\Pulpit\\YuLeech-bbo_en_setup_07_exe.exe"="C:\\Documents and Settings\\Admin\\Pulpit\\YuLeech-bbo_en_setup_07_exe.exe:*:Enabled:YuLeech" "C:\\Documents and Settings\\Admin\\Pulpit\\YuLeech-bbo_patch_en_0_7_exe.exe"="C:\\Documents and Settings\\Admin\\Pulpit\\YuLeech-bbo_patch_en_0_7_exe.exe:*:Enabled:YuLeech" "E:\\Program Files\\Red Orchestra\\steamapps\\common\\red orchestra\\System\\RedOrchestra.exe"="E:\\Program Files\\Red Orchestra\\steamapps\\common\\red orchestra\\System\\RedOrchestra.exe:*:Enabled:RedOrchestra" "D:\\Program Files\\Ubi Soft\\IL-2 Sturmovik Forgotten Battles\\if2fb-KFGD63.exe"="D:\\Program Files\\Ubi Soft\\IL-2 Sturmovik Forgotten Battles\\if2fb-KFGD63.exe:*:Enabled:if2fb-KFGD63" "C:\\Program Files\\mysql-5.0.21-win32\\bin\\mysqld.exe"="C:\\Program Files\\mysql-5.0.21-win32\\bin\\mysqld.exe:*:Disabled:mysqld" "C:\\WINDOWS\\Installer\\{6D6204C8-6B1D-4FBA-ADA9-CB6DFF9BF80D}\\_9DCF3A5882F9A54CB7BBF7.exe"="C:\\WINDOWS\\Installer\\{6D6204C8-6B1D-4FBA-ADA9-CB6DFF9BF80D}\\_9DCF3A5882F9A54CB7BBF7.exe:*:Enabled:_9DCF3A5882F9A54CB7BBF7" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Wed 9 Apr 2008 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Mon 22 Sep 2008 1,781,804 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5465248450ab857ff68e0e3d1fe8e48f\BIT45D.tmp" [b]Finished![/b]

Kod: Zaznacz wszystko: ComboFix 08-10-27.01 - Admin 2008-10-27 22:18:32.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.743 [GMT 1:00] * Utworzono nowy punkt przywracania * Resident AV is active [color=RED][b]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\Mozilla Firefox\plugins\NPMyGlSh.dll C:\WINDOWS\system32\SkypeComm.dll . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-27 do 2008-10-27 ))))))))))))))))))))))))))))))) . 2008-10-27 22:06 . 2008-10-27 22:06 <DIR> d-------- C:\WINDOWS\ERUNT 2008-10-27 22:05 . 2008-10-27 22:19 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-10-27 22:05 . 2008-03-09 13:09 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-10-27 22:05 . 2008-03-09 12:16 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-10-27 22:05 . 2008-03-09 13:09 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-10-27 22:05 . 2008-03-09 13:09 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-10-27 22:05 . 2008-03-09 13:09 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-10-27 22:05 . 2008-03-09 13:09 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-10-27 22:05 . 2008-10-27 22:05 <DIR> d-------- C:\Documents and Settings\Administrator 2008-10-27 22:03 . 2008-10-27 22:12 <DIR> d-------- C:\SDFix 2008-10-26 12:52 . 2008-10-26 12:53 <DIR> d-------- C:\Program Files\Winamp 2008-10-26 12:52 . 2008-10-26 12:53 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Winamp 2008-10-21 19:32 . 2008-10-21 19:32 0 --a------ C:\WINDOWS\system32\turek.sql 2008-10-21 19:31 . 2008-10-21 19:31 0 --a------ C:\WINDOWS\system32\PLIK.sql 2008-10-09 21:30 . 2008-10-09 21:30 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\America's Army Deploy Client 2008-10-08 19:46 . 2008-10-08 19:46 <DIR> d-------- C:\Program Files\MySQL 2008-10-07 08:36 . 2008-10-07 08:36 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Trymedia . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-26 20:52 139,144 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-10-26 20:52 111,928 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-10-24 17:36 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\teamspeak2 2008-10-22 15:58 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Image Zone Express 2008-10-20 16:20 --------- d-----w C:\Program Files\Gadu-Gadu 2008-10-16 16:26 --------- d-----w C:\Program Files\FlashGet 2008-10-03 15:21 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\gtk-2.0 2008-10-01 11:10 --------- d-----w C:\Program Files\WinISD 2008-09-28 15:43 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-22 16:32 --------- d-----w C:\Program Files\Nokia 2008-09-22 16:31 --------- d-----w C:\Program Files\Common Files\PCSuite 2008-09-22 16:31 --------- d-----w C:\Program Files\Common Files\Nokia 2008-09-22 16:30 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Downloaded Installations 2008-09-22 16:09 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-09-22 16:09 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-09-22 15:15 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-09-22 15:14 --------- d-----w C:\Program Files\DIFX 2008-09-22 14:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-09-22 13:33 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nokia Multimedia Player 2008-09-22 13:33 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Datalayer 2008-09-22 13:32 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nokia 2008-09-22 13:30 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\PC Suite 2008-09-02 18:36 --------- d-----w C:\Program Files\Samsung 2008-09-02 18:28 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Samsung . ------- Sigcheck ------- 2004-08-03 22:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\dllcache\tcpip.sys 2004-08-03 22:14 359040 6a603809f598332dbedd535bdbce313e C:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((( snapshot@2008-05-30_23.34.39,48 ))))))))))))))))))))))))))))))))))))))))) . + 2006-11-02 05:22:52 51,680 -c----w C:\WINDOWS\$NtUninstallWdf01005$\spuninst\Kmdfcustom.dll + 2006-10-08 19:51:14 221,488 -c----w C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe + 2006-10-08 19:51:14 379,184 -c----w C:\WINDOWS\$NtUninstallWdf01005$\spuninst\updspapi.dll + 2008-08-14 21:21:50 4,096 ----a-w C:\WINDOWS\d3dx.dat - 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE + 2005-10-20 19:02:28 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-10-27 21:06:23 393,216 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-10-27 21:06:23 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-10-27 21:06:15 393,216 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-10-27 21:06:15 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat + 2008-10-08 18:50:18 22,486 ----a-r C:\WINDOWS\Installer\{3CB15F63-7D48-4694-B68E-3D6E25D5C932}\InstConfIcon.exe + 2008-10-08 18:50:18 23,558 ----a-r C:\WINDOWS\Installer\{3CB15F63-7D48-4694-B68E-3D6E25D5C932}\MysqlCmdShell.exe + 2008-10-08 18:50:18 22,486 ----a-r C:\WINDOWS\Installer\{3CB15F63-7D48-4694-B68E-3D6E25D5C932}\MySQLServer.exe + 2008-09-28 15:43:08 45,056 ----a-r C:\WINDOWS\Installer\{83437081-8186-4F63-BD39-4BE8A691E055}\ARPPRODUCTICON.exe + 2008-09-28 15:43:08 5,430 ----a-r C:\WINDOWS\Installer\{83437081-8186-4F63-BD39-4BE8A691E055}\DesktopShortcut1.exe + 2008-09-28 15:43:08 45,056 ----a-r C:\WINDOWS\Installer\{83437081-8186-4F63-BD39-4BE8A691E055}\NewShortcut1.exe + 2008-09-28 15:43:08 45,056 ----a-r C:\WINDOWS\Installer\{83437081-8186-4F63-BD39-4BE8A691E055}\NewShortcut1_1.exe + 2008-09-28 15:43:08 49,152 ----a-r C:\WINDOWS\Installer\{83437081-8186-4F63-BD39-4BE8A691E055}\ProgramMenuShortcut6.exe + 2008-09-28 15:43:08 45,056 ----a-r C:\WINDOWS\Installer\{83437081-8186-4F63-BD39-4BE8A691E055}\ProgramMenuShortcut8.exe + 2008-10-23 15:48:25 10,134 ----a-r C:\WINDOWS\Installer\{E6B6FA66-92E7-4859-B0C6-1E70FC9700FD}\callmsi.exe + 2008-10-23 15:48:25 136,448 ----a-r C:\WINDOWS\Installer\{E6B6FA66-92E7-4859-B0C6-1E70FC9700FD}\egui.exe + 2008-09-22 16:32:14 23,558 ----a-r C:\WINDOWS\Installer\{FF059F2A-62A7-4E6A-B305-559591D2769E}\ARPPRODUCTICON.exe + 2008-09-22 16:32:14 65,536 ----a-r C:\WINDOWS\Installer\{FF059F2A-62A7-4E6A-B305-559591D2769E}\NewShortcut1_686D32A3E0BF41B1A4513B59D52466AB.exe + 2008-09-22 16:32:14 65,536 ----a-r C:\WINDOWS\Installer\{FF059F2A-62A7-4E6A-B305-559591D2769E}\NokiaPCSuite1_686D32A3E0BF41B1A4513B59D52466AB.exe - 2000-08-31 06:00:00 28,160 ----a-w C:\WINDOWS\Nircmd.exe + 2000-08-31 07:00:00 28,672 ----a-w C:\WINDOWS\Nircmd.exe - 2000-08-31 06:00:00 161,792 ----a-w C:\WINDOWS\swreg.exe + 2000-08-31 07:00:00 161,792 ----a-w C:\WINDOWS\swreg.exe + 2005-11-29 12:03:52 92,216 ----a-w C:\WINDOWS\system32\bass.dll + 2005-11-30 17:21:58 25,688 ----a-w C:\WINDOWS\system32\bass_fx.dll + 2005-11-21 14:29:20 5,688 ----a-w C:\WINDOWS\system32\bassenc.dll + 2008-06-17 13:01:09 2,560 ----a-w C:\WINDOWS\system32\bitcometres.dll + 2005-12-07 09:29:18 643,072 ----a-w C:\WINDOWS\system32\CDDBControlNokia.dll + 2005-12-07 09:30:34 770,048 ----a-w C:\WINDOWS\system32\CDDBUINokia.dll + 2008-07-09 08:19:22 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll + 2005-11-29 10:49:54 246,272 ----a-w C:\WINDOWS\system32\ConnAPI.dll + 2005-03-19 00:19:58 2,337,488 ----a-w C:\WINDOWS\system32\d3dx9_25.dll + 2005-11-28 07:08:32 115,712 ----a-w C:\WINDOWS\system32\DAAPI.dll + 2005-04-13 13:54:22 331,184 ----a-w C:\WINDOWS\system32\difxapi.dll + 2001-08-17 20:55:56 6,144 -c--a-w C:\WINDOWS\system32\dllcache\kbd101b.dll + 2001-08-17 20:55:56 6,144 -c--a-w C:\WINDOWS\system32\dllcache\kbd101c.dll + 2001-08-17 20:55:56 5,632 -c--a-w C:\WINDOWS\system32\dllcache\kbd103.dll + 2001-08-17 20:55:56 6,144 -c--a-w C:\WINDOWS\system32\dllcache\kbd106.dll + 2001-08-18 04:36:18 8,704 -c--a-w C:\WINDOWS\system32\dllcache\kbdjpn.dll + 2001-08-18 04:36:18 8,192 -c--a-w C:\WINDOWS\system32\dllcache\kbdkor.dll - 2008-03-13 14:43:42 40,456 ----a-w C:\WINDOWS\system32\drivers\eamon.sys + 2008-07-01 06:56:22 39,944 ----a-w C:\WINDOWS\system32\drivers\eamon.sys - 2008-03-13 14:44:36 29,704 ----a-w C:\WINDOWS\system32\drivers\easdrv.sys + 2008-07-01 06:57:14 53,256 ----a-w C:\WINDOWS\system32\drivers\easdrv.sys - 2008-03-13 14:52:18 33,800 ----a-w C:\WINDOWS\system32\drivers\epfwtdir.sys + 2008-07-01 07:04:40 34,312 ----a-w C:\WINDOWS\system32\drivers\epfwtdir.sys + 2008-07-11 08:56:03 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys + 2005-10-13 06:15:18 124,928 ----a-w C:\WINDOWS\system32\drivers\nmwcd.sys + 2005-10-13 06:15:18 8,704 ----a-w C:\WINDOWS\system32\drivers\nmwcdc.sys + 2005-10-13 06:15:18 12,800 ----a-w C:\WINDOWS\system32\drivers\nmwcdcm.sys + 2007-09-17 13:53:26 21,632 ----a-w C:\WINDOWS\system32\drivers\pccsmcfd.sys + 2007-05-02 09:11:16 83,592 ----a-w C:\WINDOWS\system32\drivers\ss_bus.sys + 2007-05-02 09:11:16 12,424 ----a-w C:\WINDOWS\system32\drivers\ss_cm.sys + 2007-05-02 09:11:16 12,424 ----a-w C:\WINDOWS\system32\drivers\ss_cmnt.sys + 2007-05-02 09:11:18 15,112 ----a-w C:\WINDOWS\system32\drivers\ss_mdfl.sys + 2007-05-02 09:11:18 109,704 ----a-w C:\WINDOWS\system32\drivers\ss_mdm.sys + 2007-05-02 09:11:18 12,424 ----a-w C:\WINDOWS\system32\drivers\ss_wh.sys + 2007-05-02 09:11:18 12,424 ----a-w C:\WINDOWS\system32\drivers\ss_whnt.sys + 2006-07-24 14:05:00 5,632 ----a-w C:\WINDOWS\system32\drivers\StarOpen.sys + 2006-11-02 05:22:54 492,000 ------w C:\WINDOWS\system32\drivers\wdf01000.sys + 2006-11-02 05:22:52 32,224 ------w C:\WINDOWS\system32\drivers\wdfldr.sys + 2000-08-19 18:29:32 268,048 ----a-w C:\WINDOWS\system32\dxtmeta2.dll - 2008-03-12 07:57:04 191,384 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT + 2008-08-19 10:48:48 192,184 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT + 2006-05-03 20:53:54 174,592 ----a-w C:\WINDOWS\system32\framedyn.dll + 2001-08-17 20:55:56 6,144 ----a-w C:\WINDOWS\system32\kbd101b.dll + 2001-08-17 20:55:56 6,144 ----a-w C:\WINDOWS\system32\kbd101c.dll + 2001-08-17 20:55:56 5,632 ----a-w C:\WINDOWS\system32\kbd103.dll + 2001-08-17 20:55:56 6,144 ----a-w C:\WINDOWS\system32\kbd106.dll + 2001-08-18 04:36:18 8,704 ----a-w C:\WINDOWS\system32\kbdjpn.dll + 2001-08-18 04:36:18 8,192 ----a-w C:\WINDOWS\system32\kbdkor.dll - 2002-02-04 01:52:54 1,230,336 ----a-w C:\WINDOWS\system32\msxml4.dll + 2003-04-18 14:46:22 1,233,920 ----a-w C:\WINDOWS\system32\msxml4.dll + 2005-11-24 08:53:20 110,592 ----a-w C:\WINDOWS\system32\NclAPI.dll + 2005-10-28 11:51:32 26,624 ----a-w C:\WINDOWS\system32\NclTools.dll + 2005-10-13 06:15:16 48,128 ----a-w C:\WINDOWS\system32\nmwcdcls.dll + 2005-10-13 06:15:16 4,608 ----a-w C:\WINDOWS\system32\nmwcdlog.dll - 2008-03-30 08:30:07 59,440 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-10-26 10:29:22 59,440 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-03-30 08:30:07 75,486 ----a-w C:\WINDOWS\system32\perfc015.dat + 2008-10-26 10:29:22 75,486 ----a-w C:\WINDOWS\system32\perfc015.dat - 2008-03-30 08:30:07 395,200 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-10-26 10:29:22 395,200 ----a-w C:\WINDOWS\system32\perfh009.dat - 2008-03-30 08:30:07 451,220 ----a-w C:\WINDOWS\system32\perfh015.dat + 2008-10-26 10:29:22 451,220 ----a-w C:\WINDOWS\system32\perfh015.dat + 2007-05-02 09:11:16 83,592 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\1\i386\ss_bus.sys + 2007-05-02 09:11:16 12,424 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\1\i386\ss_cmnt.sys + 2007-05-02 09:11:18 15,112 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\1\i386\ss_mdfl.sys + 2007-05-02 09:11:18 109,704 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\1\i386\ss_mdm.sys + 2007-05-02 09:11:18 12,424 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\1\i386\ss_whnt.sys + 2007-05-02 09:11:12 72,968 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\1\SS_Uninstall.exe + 2007-05-02 09:12:34 83,592 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\2\i386\ssm_bus.sys + 2007-05-02 09:12:34 12,424 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\2\i386\ssm_cmnt.sys + 2007-05-02 09:12:36 15,112 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\2\i386\ssm_mdfl.sys + 2007-05-02 09:12:36 109,704 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\2\i386\ssm_mdm.sys + 2007-05-02 09:12:36 12,424 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\2\i386\ssm_whnt.sys + 2007-05-02 09:12:28 72,968 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\2\SSM_Uninstall.exe + 2007-07-03 14:54:24 80,552 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\3\i386\sscdbus.sys + 2007-07-03 14:56:00 9,256 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\3\i386\sscdcmnt.sys + 2007-07-03 14:57:24 11,944 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\3\i386\sscdmdfl.sys + 2007-07-03 14:58:20 106,792 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\3\i386\sscdmdm.sys + 2007-07-03 14:59:10 86,824 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\3\i386\sscdserd.sys + 2007-07-03 15:00:16 9,256 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\3\i386\sscdwhnt.sys + 2007-07-03 14:53:24 70,824 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\3\SSCDUninstall.exe + 2007-07-05 10:37:34 83,456 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\5\i386\sssdbus.sys + 2007-07-05 10:37:34 12,160 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\5\i386\sssdcmnt.sys + 2007-07-05 10:37:34 14,848 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\5\i386\sssdmdfl.sys + 2007-07-05 10:37:34 109,696 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\5\i386\sssdmdm.sys + 2007-07-05 10:37:34 103,808 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\5\i386\sssdmgmt.sys + 2007-07-05 10:37:36 99,712 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\5\i386\sssdobex.sys + 2007-07-05 10:37:36 12,160 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\5\i386\sssdwhnt.sys + 2007-07-19 07:44:10 70,904 ----a-w C:\WINDOWS\system32\Samsung_USB_Drivers\5\SSSDUninstall.exe - 2005-05-04 13:45:28 15,584 ------w C:\WINDOWS\system32\spmsg.dll + 2006-10-08 19:51:14 14,640 ------w C:\WINDOWS\system32\spmsg.dll - 2005-02-25 03:36:06 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe + 2006-10-08 19:51:14 23,856 ----a-w C:\WINDOWS\system32\spupdsvc.exe + 2004-05-03 11:26:46 200,704 ----a-w C:\WINDOWS\system32\teulKit.dll + 2008-09-22 16:31:39 1,233,920 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8ff50c5d\msxml4.dll + 2006-12-01 20:56:00 96,256 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll . -- Migawka wyzerowana -- . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 8491008] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 81920] "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-07-01 1447168] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 15360] [HKLM\~\startupfolder\C:^Documents and Settings^Admin^Menu Start^Programy^Autostart^GM_DevUpdate.lnk] path=C:\Documents and Settings\Admin\Menu Start\Programy\Autostart\GM_DevUpdate.lnk backup=C:\WINDOWS\pss\GM_DevUpdate.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AudioDeck] -ra------ 2006-09-05 18:28 540672 C:\Program Files\VIAudioi\SBADeck\ADeck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2005-05-11 23:12 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] --a------ 2005-12-13 07:49 217088 C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2007-10-04 17:14 1626112 C:\WINDOWS\system32\nwiz.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "D:\\Program Files\\AA\\System\\ArmyOps.exe"= "D:\\Program Files\\AA\\System\\Server.exe"= "C:\\Program Files\\FlashGet\\flashget.exe"= "C:\\Program Files\\BearShare\\BearShare.exe"= "C:\\WINDOWS\\system32\\dpnsvr.exe"= "C:\\Program Files\\BitComet\\BitComet.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "D:\\Program Files\\Illusion Softworks\\Hidden and Dangerous 2 Sabre Squadron\\HD2_SabreSquadron.exe"= "D:\\Program Files\\Illusion Softworks\\Hidden & Dangerous 2\\hd2.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "E:\\Program Files\\Red Orchestra\\steamapps\\common\\red orchestra\\System\\RedOrchestra.exe"= "D:\\Program Files\\Ubi Soft\\IL-2 Sturmovik Forgotten Battles\\if2fb-KFGD63.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "11523:TCP"= 11523:TCP:BitComet 11523 TCP "11523:UDP"= 11523:UDP:BitComet 11523 UDP "18788:TCP"= 18788:TCP:BitComet 18788 TCP "18788:UDP"= 18788:UDP:BitComet 18788 UDP "9000:TCP"= 9000:TCP:BitComet 9000 TCP "9000:UDP"= 9000:UDP:BitComet 9000 UDP R0 VirtualK;VirtaulK;C:\WINDOWS\system32\drivers\VirtualK.sys [2003-11-27 3968] R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-07-01 34312] R3 skbusenum;SKBus Enumerator;C:\WINDOWS\system32\DRIVERS\skbusenum.sys [2004-12-16 10880] S3 GMFilter;GMFilter HID Filter Driver;C:\WINDOWS\system32\DRIVERS\GMFilter.sys [2005-08-23 21760] S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2007-05-02 83592] S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2007-05-02 15112] S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2007-05-02 109704] . - - - - USUNIĘTO PUSTE WPISY - - - - HKLM-Run-WinampAgent - C:\Program Files\Winamp\winampa.exe . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\Admin\Dane aplikacji\Mozilla\Firefox\Profiles\f45qbmft.default\ FF -: plugin - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\browser\nppdf32.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPMyGlSh.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPplaynet.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-27 22:19:42 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MySQL] "ImagePath"="\"C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\"C:\Program Files\MySQL\MySQL Server 5.0\my.ini\" MySQL" . Czas ukończenia: 2008-10-27 22:20:58 ComboFix-quarantined-files.txt 2008-10-27 21:20:53 ComboFix2.txt 2008-05-30 21:34:51 Przed: 6,225,592,320 bajtów wolnych Po: 6,229,372,928 bajtów wolnych 290 --- E O F --- 2008-03-22 08:16:15

**Posty:** 18165 · przez **wojtas** 27 Paź 2008, 23:43

edytuj i wstaw taki code..

**Posty:** 7956 · przez **Magik** 27 Paź 2008, 23:47

Kolego nie rob bajzlu, popraw te logi i wklej w tagi 'code' juz :!:

wklej do notatnika

Kod: Zaznacz wszystko: FILE:: C:\WINDOWS\Nircmd.exe C:\WINDOWS\swreg.exe

Plik -> zapisz jako -> CFScript.txt.
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe

przeskanuj kompa
http://www.kaspersky.com/virusscanner

**Posty:** 684 · przez **djarta** 28 Paź 2008, 09:12

Magik napisał(a):Kolego nie rob bajzlu, popraw te logi i wklej w tagi 'code' juz

wklej do notatnika

Kod: Zaznacz wszystko
FILE:: C:\WINDOWS\Nircmd.exe C:\WINDOWS\swreg.exe

Plik -> zapisz jako -> CFScript.txt.
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe

przeskanuj kompa
http://www.kaspersky.com/virusscanner

Log jest czysty.

================
K.

**Posty:** 56 · przez **LOko "noob"** 28 Paź 2008, 20:49

Troszkę już posprzątałem (pozamieniałem tagi na CODE).

Aktualnie ściąga mi się Kaspersky Online Scanner.

Aktualny log z combofixa:

Kod: Zaznacz wszystko: ComboFix 08-10-27.01 - Admin 2008-10-28 19:31:41.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.731 [GMT 1:00] Użyto następujących komend :: C:\Documents and Settings\Admin\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania * Resident AV is active [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] FILE :: C:\WINDOWS\Nircmd.exe C:\WINDOWS\swreg.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\Nircmd.exe C:\WINDOWS\swreg.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-28 do 2008-10-28 ))))))))))))))))))))))))))))))) . 2008-10-27 22:06 . 2008-10-27 22:06 <DIR> d-------- C:\WINDOWS\ERUNT 2008-10-27 22:05 . 2008-10-28 19:32 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-10-27 22:05 . 2008-03-09 13:09 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-10-27 22:05 . 2008-03-09 12:16 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-10-27 22:05 . 2008-03-09 13:09 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-10-27 22:05 . 2008-03-09 13:09 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-10-27 22:05 . 2008-03-09 13:09 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-10-27 22:05 . 2008-03-09 13:09 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-10-27 22:05 . 2008-10-27 22:05 <DIR> d-------- C:\Documents and Settings\Administrator 2008-10-27 22:03 . 2008-10-27 22:12 <DIR> d-------- C:\SDFix 2008-10-26 12:52 . 2008-10-26 12:53 <DIR> d-------- C:\Program Files\Winamp 2008-10-26 12:52 . 2008-10-26 12:53 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Winamp 2008-10-21 19:32 . 2008-10-21 19:32 0 --a------ C:\WINDOWS\system32\turek.sql 2008-10-21 19:31 . 2008-10-21 19:31 0 --a------ C:\WINDOWS\system32\PLIK.sql 2008-10-09 21:30 . 2008-10-09 21:30 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\America's Army Deploy Client 2008-10-08 19:46 . 2008-10-08 19:46 <DIR> d-------- C:\Program Files\MySQL 2008-10-07 08:36 . 2008-10-07 08:36 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Trymedia . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-26 20:52 139,144 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-10-26 20:52 111,928 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-10-24 17:36 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\teamspeak2 2008-10-22 15:58 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Image Zone Express 2008-10-20 16:20 --------- d-----w C:\Program Files\Gadu-Gadu 2008-10-16 16:26 --------- d-----w C:\Program Files\FlashGet 2008-10-03 15:21 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\gtk-2.0 2008-10-01 11:10 --------- d-----w C:\Program Files\WinISD 2008-09-28 15:43 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-22 16:32 --------- d-----w C:\Program Files\Nokia 2008-09-22 16:31 --------- d-----w C:\Program Files\Common Files\PCSuite 2008-09-22 16:31 --------- d-----w C:\Program Files\Common Files\Nokia 2008-09-22 16:30 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Downloaded Installations 2008-09-22 16:09 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-09-22 16:09 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-09-22 15:15 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-09-22 15:14 --------- d-----w C:\Program Files\DIFX 2008-09-22 14:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-09-22 13:33 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nokia Multimedia Player 2008-09-22 13:33 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Datalayer 2008-09-22 13:32 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nokia 2008-09-22 13:30 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\PC Suite 2008-09-02 18:36 --------- d-----w C:\Program Files\Samsung 2008-09-02 18:28 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Samsung . ------- Sigcheck ------- 2004-08-03 22:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\dllcache\tcpip.sys 2004-08-03 22:14 359040 6a603809f598332dbedd535bdbce313e C:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 8491008] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 81920] "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-07-01 1447168] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 15360] [HKLM\~\startupfolder\C:^Documents and Settings^Admin^Menu Start^Programy^Autostart^GM_DevUpdate.lnk] path=C:\Documents and Settings\Admin\Menu Start\Programy\Autostart\GM_DevUpdate.lnk backup=C:\WINDOWS\pss\GM_DevUpdate.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AudioDeck] -ra------ 2006-09-05 18:28 540672 C:\Program Files\VIAudioi\SBADeck\ADeck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2005-05-11 23:12 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] --a------ 2005-12-13 07:49 217088 C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2007-10-04 17:14 1626112 C:\WINDOWS\system32\nwiz.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "D:\\Program Files\\AA\\System\\ArmyOps.exe"= "D:\\Program Files\\AA\\System\\Server.exe"= "C:\\Program Files\\FlashGet\\flashget.exe"= "C:\\Program Files\\BearShare\\BearShare.exe"= "C:\\WINDOWS\\system32\\dpnsvr.exe"= "C:\\Program Files\\BitComet\\BitComet.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "D:\\Program Files\\Illusion Softworks\\Hidden and Dangerous 2 Sabre Squadron\\HD2_SabreSquadron.exe"= "D:\\Program Files\\Illusion Softworks\\Hidden & Dangerous 2\\hd2.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "E:\\Program Files\\Red Orchestra\\steamapps\\common\\red orchestra\\System\\RedOrchestra.exe"= "D:\\Program Files\\Ubi Soft\\IL-2 Sturmovik Forgotten Battles\\if2fb-KFGD63.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "11523:TCP"= 11523:TCP:BitComet 11523 TCP "11523:UDP"= 11523:UDP:BitComet 11523 UDP "18788:TCP"= 18788:TCP:BitComet 18788 TCP "18788:UDP"= 18788:UDP:BitComet 18788 UDP "9000:TCP"= 9000:TCP:BitComet 9000 TCP "9000:UDP"= 9000:UDP:BitComet 9000 UDP R0 VirtualK;VirtaulK;C:\WINDOWS\system32\drivers\VirtualK.sys [2003-11-27 3968] R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-07-01 34312] R3 skbusenum;SKBus Enumerator;C:\WINDOWS\system32\DRIVERS\skbusenum.sys [2004-12-16 10880] S3 GMFilter;GMFilter HID Filter Driver;C:\WINDOWS\system32\DRIVERS\GMFilter.sys [2005-08-23 21760] S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2007-05-02 83592] S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2007-05-02 15112] S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2007-05-02 109704] . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-28 19:32:45 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MySQL] "ImagePath"="\"C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\"C:\Program Files\MySQL\MySQL Server 5.0\my.ini\" MySQL" . Czas ukończenia: 2008-10-28 19:34:12 ComboFix-quarantined-files.txt 2008-10-28 18:34:08 ComboFix2.txt 2008-10-28 14:53:51 ComboFix3.txt 2008-10-27 21:20:59 ComboFix4.txt 2008-05-30 21:34:51 Przed: 6,227,083,264 bajtów wolnych Po: 6,219,079,680 bajtów wolnych 155 --- E O F --- 2008-03-22 08:16:15

Zobaczymy co pokaże kaspersky

**Posty:** 7956 · przez **Magik** 28 Paź 2008, 21:04

LOko "noob" napisał(a):Zobaczymy co pokaże kaspersky

Jak Kasper nic nie pokaze tzn. po sprawie

Pozdrawiam

**Posty:** 56 · przez **LOko "noob"** 28 Paź 2008, 23:17

Jednak coś wykrył:

Kod: Zaznacz wszystko: KASPERSKY ONLINE SCANNER 7 REPORT Tuesday, October 28, 2008 Operating System: Microsoft Windows XP Professional Dodatek Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Tuesday, October 28, 2008 16:19:40 Records in database: 1354503 Scan settings Scan using the following database extended Scan archives yes Scan mail databases yes Scan area My Computer A:\ C:\ D:\ E:\ F:\ G:\ Scan statistics Files scanned 74041 Threat name 2 Infected objects 2 Suspicious objects 0 Duration of the scan 01:54:18 File name Threat name Threats count C:\QooBox\Quarantine\C\Program Files\Mozilla Firefox\plugins\NPMyGlSh.dll.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.i 1 C:\QooBox\Quarantine\C\WINDOWS\system32\SkypeComm.dll.vir Infected: Trojan-Spy.Win32.BHO.i 1 The selected area was scanned.

**Posty:** 7956 · przez **Magik** 28 Paź 2008, 23:22

ale w kwarantannie combo, standard

usun recznie plik z dysku

C:\QooBox\

i po sprawie

**Posty:** 56 · przez **LOko "noob"** 29 Paź 2008, 09:48

Magik napisał(a):ale w kwarantannie combo, standard

usun recznie plik z dysku

C:\QooBox\

i po sprawie

Już usunąłem

Tylko dalej jak wejdę w system32 i najadę na dmserver.dll uaktywnia się Nod i mówi że dalej jest tam wirus. Czy tak musi zastać??

Kod: Zaznacz wszystko: 2008-10-29 08:49:34 Ochrona systemu plików w czasie rzeczywistym plik C:\WINDOWS\system32\dmserver.dll Win32/Patched.BU wirus ZARZĄDZANIE NT\SYSTEM Zdarzenie wystąpiło podczas próby uzyskania dostępu do pliku przez aplikację: C:\WINDOWS\Explorer.EXE.

**Posty:** 7956 · przez **Magik** 29 Paź 2008, 13:26

tego pliku w logach nie widac

to wyrzucimy go

wklej do notatnika

Kod: Zaznacz wszystko: FILE:: C:\WINDOWS\system32\dmserver.dll

Plik -> zapisz jako -> CFScript.txt.
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe

**Posty:** 56 · przez **LOko "noob"** 30 Paź 2008, 10:26

Mam nadzieję że teraz to już usunięty na dobre

Kod: Zaznacz wszystko: ComboFix 08-10-27.01 - Admin 2008-10-30 9:13:22.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.730 [GMT 1:00] Użyto następujących komend :: C:\Documents and Settings\Admin\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania * Resident AV is active [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] FILE :: C:\WINDOWS\system32\dmserver.dll . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\dmserver.dll . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-28 do 2008-10-30 ))))))))))))))))))))))))))))))) . 2008-10-27 22:06 . 2008-10-27 22:06 <DIR> d-------- C:\WINDOWS\ERUNT 2008-10-27 22:05 . 2008-10-28 19:34 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-10-27 22:05 . 2008-03-09 13:09 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-10-27 22:05 . 2008-03-09 12:16 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-10-27 22:05 . 2008-03-09 13:09 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-10-27 22:05 . 2008-03-09 13:09 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-10-27 22:05 . 2008-03-09 13:09 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-10-27 22:05 . 2008-03-09 13:09 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-10-27 22:05 . 2008-10-27 22:05 <DIR> d-------- C:\Documents and Settings\Administrator 2008-10-27 22:03 . 2008-10-27 22:12 <DIR> d-------- C:\SDFix 2008-10-26 12:52 . 2008-10-26 12:53 <DIR> d-------- C:\Program Files\Winamp 2008-10-26 12:52 . 2008-10-26 12:53 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Winamp 2008-10-21 19:32 . 2008-10-21 19:32 0 --a------ C:\WINDOWS\system32\turek.sql 2008-10-21 19:31 . 2008-10-21 19:31 0 --a------ C:\WINDOWS\system32\PLIK.sql 2008-10-09 21:30 . 2008-10-09 21:30 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\America's Army Deploy Client 2008-10-08 19:46 . 2008-10-08 19:46 <DIR> d-------- C:\Program Files\MySQL 2008-10-07 08:36 . 2008-10-07 08:36 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Trymedia 2008-09-24 21:06 . 2008-10-01 12:10 <DIR> d-------- C:\Program Files\WinISD 2008-09-22 17:31 . 2008-09-22 17:31 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-09-22 17:31 . 2008-09-22 17:31 <DIR> d-------- C:\Program Files\Common Files\Nokia 2008-09-22 17:09 . 2008-09-22 17:09 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-09-22 17:09 . 2008-09-22 17:09 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-09-22 16:15 . 2008-09-22 16:15 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-09-22 16:14 . 2008-09-22 16:14 <DIR> d-------- C:\Program Files\DIFX 2008-09-22 16:14 . 2007-09-17 14:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys 2008-09-22 16:13 . 2008-09-22 17:32 <DIR> d-------- C:\Program Files\Nokia 2008-09-22 15:32 . 2008-09-22 15:32 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-09-22 14:33 . 2008-09-22 15:08 <DIR> d-------- C:\Documents and Settings\Admin\Phone Browser 2008-09-22 14:33 . 2008-09-22 14:33 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Nokia Multimedia Player 2008-09-22 14:33 . 2008-09-22 14:33 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Datalayer 2008-09-22 14:32 . 2008-09-22 14:32 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Nokia 2008-09-22 14:30 . 2008-09-22 14:30 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\PC Suite 2008-09-22 14:29 . 2008-09-22 17:30 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Downloaded Installations 2008-09-16 17:50 . 2008-09-16 17:50 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy 2008-09-02 19:28 . 2008-09-02 19:28 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Samsung 2008-09-02 19:27 . 2006-05-03 21:53 174,592 --a------ C:\WINDOWS\system32\framedyn.dll 2008-09-02 19:26 . 2006-07-24 15:05 5,632 --a------ C:\WINDOWS\system32\drivers\StarOpen.sys 2008-09-02 19:25 . 2008-09-02 19:25 <DIR> d-------- C:\WINDOWS\system32\Samsung_USB_Drivers 2008-09-02 19:25 . 2008-09-02 19:36 <DIR> d-------- C:\Program Files\Samsung 2008-09-02 19:25 . 2007-05-02 10:11 109,704 --a------ C:\WINDOWS\system32\drivers\ss_mdm.sys 2008-09-02 19:25 . 2007-05-02 10:11 83,592 --a------ C:\WINDOWS\system32\drivers\ss_bus.sys 2008-09-02 19:25 . 2007-05-02 10:11 15,112 --a------ C:\WINDOWS\system32\drivers\ss_mdfl.sys 2008-09-02 19:25 . 2007-05-02 10:11 12,424 --a------ C:\WINDOWS\system32\drivers\ss_whnt.sys 2008-09-02 19:25 . 2007-05-02 10:11 12,424 --a------ C:\WINDOWS\system32\drivers\ss_wh.sys 2008-09-02 19:25 . 2007-05-02 10:11 12,424 --a------ C:\WINDOWS\system32\drivers\ss_cmnt.sys 2008-09-02 19:25 . 2007-05-02 10:11 12,424 --a------ C:\WINDOWS\system32\drivers\ss_cm.sys 2008-09-02 19:25 . 2005-08-28 19:51 766 --a------ C:\WINDOWS\system32\Uninstall.ico . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-28 20:01 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\teamspeak2 2008-10-26 20:52 139,144 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-10-26 20:52 111,928 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-10-22 15:58 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Image Zone Express 2008-10-20 16:20 --------- d-----w C:\Program Files\Gadu-Gadu 2008-10-16 16:26 --------- d-----w C:\Program Files\FlashGet 2008-10-03 15:21 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\gtk-2.0 2008-09-28 15:43 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-09 08:19 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll . ------- Sigcheck ------- 2004-08-03 22:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\dllcache\tcpip.sys 2004-08-03 22:14 359040 6a603809f598332dbedd535bdbce313e C:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 8491008] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 81920] "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-07-01 1447168] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 15360] [HKLM\~\startupfolder\C:^Documents and Settings^Admin^Menu Start^Programy^Autostart^GM_DevUpdate.lnk] path=C:\Documents and Settings\Admin\Menu Start\Programy\Autostart\GM_DevUpdate.lnk backup=C:\WINDOWS\pss\GM_DevUpdate.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AudioDeck] -ra------ 2006-09-05 18:28 540672 C:\Program Files\VIAudioi\SBADeck\ADeck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2005-05-11 23:12 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] --a------ 2005-12-13 07:49 217088 C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2007-10-04 17:14 1626112 C:\WINDOWS\system32\nwiz.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "D:\\Program Files\\AA\\System\\ArmyOps.exe"= "D:\\Program Files\\AA\\System\\Server.exe"= "C:\\Program Files\\FlashGet\\flashget.exe"= "C:\\Program Files\\BearShare\\BearShare.exe"= "C:\\WINDOWS\\system32\\dpnsvr.exe"= "C:\\Program Files\\BitComet\\BitComet.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "D:\\Program Files\\Illusion Softworks\\Hidden and Dangerous 2 Sabre Squadron\\HD2_SabreSquadron.exe"= "D:\\Program Files\\Illusion Softworks\\Hidden & Dangerous 2\\hd2.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "E:\\Program Files\\Red Orchestra\\steamapps\\common\\red orchestra\\System\\RedOrchestra.exe"= "D:\\Program Files\\Ubi Soft\\IL-2 Sturmovik Forgotten Battles\\if2fb-KFGD63.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "11523:TCP"= 11523:TCP:BitComet 11523 TCP "11523:UDP"= 11523:UDP:BitComet 11523 UDP "18788:TCP"= 18788:TCP:BitComet 18788 TCP "18788:UDP"= 18788:UDP:BitComet 18788 UDP "9000:TCP"= 9000:TCP:BitComet 9000 TCP "9000:UDP"= 9000:UDP:BitComet 9000 UDP R0 VirtualK;VirtaulK;C:\WINDOWS\system32\drivers\VirtualK.sys [2003-11-27 3968] R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-07-01 34312] R3 skbusenum;SKBus Enumerator;C:\WINDOWS\system32\DRIVERS\skbusenum.sys [2004-12-16 10880] S3 GMFilter;GMFilter HID Filter Driver;C:\WINDOWS\system32\DRIVERS\GMFilter.sys [2005-08-23 21760] S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2007-05-02 83592] S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2007-05-02 15112] S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2007-05-02 109704] . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-30 09:15:44 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL] "ImagePath"="\"C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\"C:\Program Files\MySQL\MySQL Server 5.0\my.ini\" MySQL" . ------------------------ Pozostałe uruchomione procesy ------------------------ . C:\WINDOWS\system32\savedump.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2008-10-30 9:18:05 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-10-30 08:18:01 ComboFix2.txt 2008-10-28 18:34:32 Przed: 6,507,548,672 bajtów wolnych Po: 6,580,977,664 bajtów wolnych 180 --- E O F --- 2008-03-22 08:16:15

Jeszcze mam takie pytanie, mianowicie po uruchomieniu pierwszy raz Combofixa w mozilli został mi taki pasek:

Da się jakoś to zlikwidować?? Wcześniej tego nie miałem

**Posty:** 7956 · przez **Magik** 30 Paź 2008, 13:20

LOko "noob" napisał(a):Mam nadzieję że teraz to już usunięty na dobre

yes, sir

LOko "noob" napisał(a):Da się jakoś to zlikwidować?? Wcześniej tego nie miałem

odinstaluj FF'a, wyczysc pozostalosci i zainstaluj na nowo//pierwsze widze tak na marg.

Autor postu otrzymał pochwałę

**Posty:** 56 · przez **LOko "noob"** 30 Paź 2008, 14:11

Dobra to po problemie

Dzięki za pomoc!

Oczywiście pochwała się należy :mrgreen: