Log(folder winfile) usuwa pliki exe

**Posty:** 202 · przez **sawio** 20 Sie 2008, 13:07

oto logi
combofix

Kod: Zaznacz wszystko: ComboFix 08-08-18.05 - Łukasz 2008-08-20 12:35:48.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.468 [GMT 2:00] Running from: E:\ComboFix.exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((( Files Created from 2008-07-20 to 2008-08-20 ))))))))))))))))))))))))))))))) . 2008-08-12 19:08 . 2008-08-12 19:08 <DIR> d-------- F:\Documents and Settings\Łukasz\Dane aplikacji\AdobeUM 2008-08-12 15:12 . 2008-08-12 15:12 <DIR> d-------- F:\Program Files\Opera 2008-08-12 12:15 . 2008-08-12 12:15 <DIR> d-------- F:\Documents and Settings\Łukasz\Dane aplikacji\Gearbox Software 2008-08-12 11:25 . 2008-08-12 11:25 <DIR> d-------- F:\Documents and Settings\úukasz\Ustawienia lokalne 2008-08-12 11:25 . 2008-08-12 11:25 <DIR> d-------- F:\Documents and Settings\úukasz 2008-08-12 10:44 . 2008-08-12 10:45 754 --a------ F:\WINDOWS\WORDPAD.INI 2008-08-12 10:29 . 2008-08-12 10:29 <DIR> d-------- F:\Program Files\ToSearch 2008-08-11 19:48 . 2008-08-11 19:48 <DIR> d-------- F:\Documents and Settings\Łukasz\Dane aplikacji\teamspeak2 2008-08-02 14:34 . 2006-06-26 03:19 2,388,176 --a------ F:\WINDOWS\system\d3dx9_30.dll 2008-07-31 10:16 . 2008-07-31 10:16 <DIR> d-------- F:\Program Files\7-Zip 2008-07-31 10:11 . 2008-07-31 10:11 <DIR> d--h----- F:\WINDOWS\amcdl 2008-07-31 09:51 . 2004-08-03 23:31 57,399 --a--c--- F:\WINDOWS\system32\dllcache\cplexe.exe 2008-07-31 09:44 . 2001-08-18 06:36 8,704 --a------ F:\WINDOWS\system32\kbdjpn.dll 2008-07-31 09:44 . 2001-08-18 06:36 8,192 --a------ F:\WINDOWS\system32\kbdkor.dll 2008-07-31 09:44 . 2001-08-17 22:55 6,144 --a------ F:\WINDOWS\system32\kbd106.dll 2008-07-31 09:44 . 2001-08-17 22:55 6,144 --a------ F:\WINDOWS\system32\kbd101c.dll 2008-07-31 09:44 . 2001-08-17 22:55 6,144 --a------ F:\WINDOWS\system32\kbd101b.dll 2008-07-31 09:44 . 2001-08-17 22:55 5,632 --a------ F:\WINDOWS\system32\kbd103.dll 2008-07-31 09:12 . 2000-03-30 16:12 110,592 --a------ F:\WINDOWS\system32\adimage.dll 2008-07-31 09:12 . 2000-04-11 21:47 57,344 --a------ F:\WINDOWS\system32\tfde.dll 2008-07-31 09:12 . 1999-11-23 10:21 36,864 --a------ F:\WINDOWS\system32\ipcclient.dll 2008-07-30 23:03 . 2008-07-30 23:03 94,636 --a------ F:\WINDOWS\dropcpyr.dll 2008-07-30 23:03 . 2008-07-30 23:03 73,728 --a------ F:\WINDOWS\copyfstq.exe 2008-07-30 16:42 . 2008-07-30 16:42 <DIR> d-------- F:\Documents and Settings\Łukasz\Dane aplikacji\Lavasoft 2008-07-30 08:18 . 2005-07-15 14:41 2,337,488 --a------ F:\WINDOWS\system\d3dx9_25.dll 2008-07-30 08:18 . 2008-07-30 08:18 98,304 --a------ F:\WINDOWS\system32\CmdLineExt.dll 2008-07-29 08:56 . 2008-07-29 08:56 479,298 --a------ F:\WINDOWS\system32\wbocx.ocx 2008-07-29 08:56 . 2008-07-29 08:56 172,032 --a------ F:\WINDOWS\system32\AniGIF.ocx 2008-07-29 08:56 . 2008-07-29 08:56 50,688 --a------ F:\WINDOWS\system32\wbhelp2.dll 2008-07-25 16:55 . 2008-07-25 16:55 <DIR> d-------- F:\Documents and Settings\ťukasz\Ustawienia lokalne 2008-07-25 16:55 . 2008-07-25 16:55 <DIR> d-------- F:\Documents and Settings\ťukasz 2008-07-24 16:36 . 2008-07-24 16:36 <DIR> d-------- F:\Program Files\Logitech 2008-07-24 16:36 . 2008-07-24 16:36 <DIR> d-------- F:\Program Files\Common Files\Logitech 2008-07-23 18:30 . 2008-07-23 18:30 <DIR> d-------- F:\WINDOWS\Sun . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-11-24 15:54 53,765 ----a-w F:\Documents and Settings\Łukasz\ftpWINFILE.EXE 2013-11-24 15:54 53,765 ----a-w F:\Documents and Settings\Łukasz\ftpWINFILE.EXE 2008-08-14 19:13 --------- d--h--w F:\Program Files\InstallShield Installation Information 2008-08-14 13:27 --------- d-----w F:\Program Files\Common Files\InstallShield 2008-07-30 07:42 --------- d-----w F:\Documents and Settings\Łukasz\Dane aplikacji\mIRC 2008-07-19 14:13 --------- d-----w F:\Program Files\MediaCoder 2008-07-18 16:13 --------- d-----w F:\Documents and Settings\Łukasz\Dane aplikacji\Thinking Minds Budiling Bytes 2008-07-18 14:52 --------- d-----w F:\Program Files\Windows Media Connect 2 2008-07-16 13:59 223,128 ----a-w F:\WINDOWS\system32\drivers\dtscsi.sys 2008-07-16 13:59 --------- d-----w F:\Program Files\DAEMON Tools 2008-07-16 13:58 96,256 ----a-w F:\WINDOWS\system32\drivers\sptd5197.sys 2008-07-16 13:58 643,072 ----a-w F:\WINDOWS\system32\drivers\sptd.sys 2008-07-16 13:56 --------- d-----w F:\Program Files\Alcohol Soft 2008-07-14 11:38 --------- d-----w F:\Program Files\Dziobas Rar Player 2008-07-07 12:28 --------- d-----w F:\Documents and Settings\Łukasz\Dane aplikacji\Media Player Classic 2008-07-07 12:27 --------- d-----w F:\Program Files\K-Lite Codec Pack 2008-07-05 19:58 --------- d-----w F:\Program Files\Sun 2008-07-05 19:57 --------- d-----w F:\Program Files\Java 2008-07-05 19:54 --------- d-----w F:\Program Files\Common Files\Java 2008-07-05 08:51 --------- d-----w F:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks 2008-07-05 08:49 --------- d-----w F:\Program Files\Winamp 2008-07-05 08:49 --------- d-----w F:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar 2008-07-04 21:04 66,872 ----a-w F:\WINDOWS\system32\PnkBstrA.exe 2008-07-04 21:04 22,328 ----a-w F:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-07-04 21:04 107,832 ----a-w F:\WINDOWS\system32\PnkBstrB.exe 2008-07-04 12:16 451,072 ----a-w F:\WINDOWS\Radeon Omega Drivers v3.8.360 Uninstall.exe 2008-07-04 12:16 --------- d-----w F:\Program Files\Radeon Omega Drivers 2008-07-04 12:16 --------- d-----w F:\Program Files\MultiRes 2008-07-03 10:15 --------- d-----w F:\Program Files\Gadu-Gadu 2008-07-03 09:47 --------- d-----w F:\Documents and Settings\Łukasz\Dane aplikacji\Creative 2008-07-03 09:46 --------- d-----w F:\Program Files\Creative 2008-07-03 09:29 --------- d-----w F:\Program Files\microsoft frontpage 2008-07-03 09:28 --------- d-----w F:\Program Files\MSXML 6.0 2008-07-03 09:28 --------- d-----w F:\Program Files\MSXML 4.0 2008-07-03 09:26 --------- d-----w F:\Program Files\Usługi online 2008-05-30 12:19 507,400 ----a-w F:\WINDOWS\system32\XAudio2_1.dll 2008-05-30 12:18 238,088 ----a-w F:\WINDOWS\system32\xactengine3_1.dll 2008-05-30 12:17 65,032 ----a-w F:\WINDOWS\system32\XAPOFX1_0.dll 2008-05-30 12:17 25,608 ----a-w F:\WINDOWS\system32\X3DAudio1_4.dll 2008-05-30 12:11 467,984 ----a-w F:\WINDOWS\system32\d3dx10_38.dll 2008-05-30 12:11 3,850,760 ----a-w F:\WINDOWS\system32\D3DX9_38.dll 2008-05-30 12:11 1,491,992 ----a-w F:\WINDOWS\system32\D3DCompiler_38.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="F:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360] "Gadu-Gadu"="C:\Gadu-Gadu\gg.exe" [2005-03-31 11:18 790528] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTSysVol"="F:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 08:13 57344] "UpdReg"="F:\WINDOWS\UpdReg.EXE" [2000-05-10 22:30 90112] "WinampAgent"="F:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352] "SunJavaUpdateSched"="F:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] "DAEMON Tools"="F:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 16:57 133016] "EM_EXEC"="F:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [2002-01-14 09:42 35328] "AtiPTA"="atiptaxx.exe" [2006-02-22 02:05 344064 F:\WINDOWS\system32\atiptaxx.exe] "Resume copy"="copyfstq.exe" [2008-07-30 23:03 73728 F:\WINDOWS\copyfstq.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll "msacm.ac3filter"= ac3filter.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "F:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\Gadu-Gadu\\gg.exe"= "D:\\gry\\PfGamesPoker\\jre\\bin\\javaw.exe"= "D:\\gry\\PointPoker\\jre\\bin\\javaw.exe"= "D:\\BearShare\\BearShare.exe"= "C:\\Program Files\\UOAM\\uoam.exe"= "D:\\totalcmd\\TOTALCMD.EXE"= "E:\\Counter-Strike\\hl.exe"= "C:\\Program Files\\BitLord\\BitLord.exe"= "E:\\DAP\\DAP.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8461:TCP"= 8461:TCP:GoD High Port "8462:TCP"= 8462:TCP:GoD Low Port R3 axvbusx;axvbusx;F:\WINDOWS\system32\DRIVERS\axvbusx.sys [2002-12-27 20:14] R3 axvscsi;axvscsi;F:\WINDOWS\system32\DRIVERS\axvscsi.sys [2002-12-27 20:14] S3 ddsxeiservice;ddsxeiservice2;C:\Program Files\sXe Injected\ddsxei.sys [2008-08-04 04:32] *Newly Created Service* - CATCHME . . ------- Supplementary Scan ------- . FireFox -: Profile - F:\Documents and Settings\Łukasz\Dane aplikacji\Mozilla\Firefox\Profiles\izggqujy.default\ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-20 12:36:57 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-20 12:37:57 ComboFix-quarantined-files.txt 2008-08-20 10:37:52 Pre-Run: 236,118,016 bajtów wolnych Post-Run: 234,614,784 bajtów wolnych

i log z hijackthis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:45:46, on 2008-08-20 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.20696) Boot mode: Normal Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\Ati2evxx.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\system32\Ati2evxx.exe F:\WINDOWS\system32\spoolsv.exe F:\Program Files\Java\jre1.6.0_06\bin\jusched.exe F:\WINDOWS\system32\ctfmon.exe F:\WINDOWS\system32\CTsvcCDA.exe F:\WINDOWS\system32\PnkBstrA.exe F:\WINDOWS\system32\PnkBstrB.exe F:\WINDOWS\system32\MsPMSPSv.exe F:\WINDOWS\system32\wscntfy.exe C:\Gadu-Gadu\gg.exe F:\WINDOWS\system32\notepad.exe F:\WINDOWS\explorer.exe F:\Program Files\Mozilla Firefox\firefox.exe c:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - F:\Program Files\Winamp Toolbar\winamptb.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - F:\Program Files\Winamp Toolbar\winamptb.dll (file missing) O4 - HKLM\..\Run: [CTSysVol] F:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [UpdReg] F:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe O4 - HKLM\..\Run: [WinampAgent] F:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [DAEMON Tools] "F:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [EM_EXEC] F:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O8 - Extra context menu item: &Download with &DAP - E:\DAP\dapextie.htm O8 - Extra context menu item: &Winamp Search - F:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: Download &all with DAP - E:\DAP\dapextie2.htm O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - E:\DAP\DAP.EXE O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\JetCar.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\JetCar.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: PnkBstrA - Unknown owner - F:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - F:\WINDOWS\system32\PnkBstrB.exe -- End of file - 5691 bytes

**Posty:** 18165 · przez **wojtas** 20 Sie 2008, 13:35

Otworz notatnik i wklej w nim to:

File::
F:\Documents and Settings\Łukasz\ftpWINFILE.EXE
F:\Documents and Settings\Łukasz\ftpWINFILE.EXE

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

Autor postu otrzymał pochwałę

**Posty:** 202 · przez **sawio** 20 Sie 2008, 17:14

oto log zrobilem tak jak napisales

Kod: Zaznacz wszystko: ComboFix 08-08-18.05 - Łukasz 2008-08-20 17:06:43.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.473 [GMT 2:00] Running from: E:\ComboFix.exe Command switches used :: E:\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: F:\Documents and Settings\Łukasz\ftpWINFILE.EXE . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . F:\Documents and Settings\Łukasz\ftpWINFILE.EXE . ((((((((((((((((((((((((( Files Created from 2008-07-20 to 2008-08-20 ))))))))))))))))))))))))))))))) . 2008-08-20 17:08 . 2008-08-20 17:08 11,651 --a------ F:\Documents and Settings\catchme.zip 2008-08-20 13:16 . 2008-08-20 13:16 <DIR> d-------- F:\WINDOWS\ERUNT 2008-08-20 13:11 . 2008-08-20 13:21 <DIR> d-------- F:\SDFix 2008-08-12 15:12 . 2008-08-12 15:12 <DIR> d-------- F:\Program Files\Opera 2008-08-12 11:25 . 2008-08-12 11:25 <DIR> d-------- F:\Documents and Settings\Łukasz 2008-08-12 11:25 . <DIR> F:\Documents and Settings\úukasz\Ustawienia lokalne 2008-08-12 11:25 . <DIR> F:\Documents and Settings\úukasz\Ustawienia lokalne 2008-08-12 10:44 . 2008-08-12 10:45 754 --a------ F:\WINDOWS\WORDPAD.INI 2008-08-12 10:29 . 2008-08-12 10:29 <DIR> d-------- F:\Program Files\ToSearch 2008-08-02 14:34 . 2006-06-26 03:19 2,388,176 --a------ F:\WINDOWS\system\d3dx9_30.dll 2008-07-31 10:16 . 2008-07-31 10:16 <DIR> d-------- F:\Program Files\7-Zip 2008-07-31 10:11 . 2008-07-31 10:11 <DIR> d--h----- F:\WINDOWS\amcdl 2008-07-31 09:51 . 2004-08-03 23:31 57,399 --a--c--- F:\WINDOWS\system32\dllcache\cplexe.exe 2008-07-31 09:44 . 2001-08-18 06:36 8,704 --a------ F:\WINDOWS\system32\kbdjpn.dll 2008-07-31 09:44 . 2001-08-18 06:36 8,192 --a------ F:\WINDOWS\system32\kbdkor.dll 2008-07-31 09:44 . 2001-08-17 22:55 6,144 --a------ F:\WINDOWS\system32\kbd106.dll 2008-07-31 09:44 . 2001-08-17 22:55 6,144 --a------ F:\WINDOWS\system32\kbd101c.dll 2008-07-31 09:44 . 2001-08-17 22:55 6,144 --a------ F:\WINDOWS\system32\kbd101b.dll 2008-07-31 09:44 . 2001-08-17 22:55 5,632 --a------ F:\WINDOWS\system32\kbd103.dll 2008-07-31 09:12 . 2000-03-30 16:12 110,592 --a------ F:\WINDOWS\system32\adimage.dll 2008-07-31 09:12 . 2000-04-11 21:47 57,344 --a------ F:\WINDOWS\system32\tfde.dll 2008-07-31 09:12 . 1999-11-23 10:21 36,864 --a------ F:\WINDOWS\system32\ipcclient.dll 2008-07-30 23:03 . 2008-07-30 23:03 94,636 --a------ F:\WINDOWS\dropcpyr.dll 2008-07-30 23:03 . 2008-07-30 23:03 73,728 --a------ F:\WINDOWS\copyfstq.exe 2008-07-30 08:18 . 2005-07-15 14:41 2,337,488 --a------ F:\WINDOWS\system\d3dx9_25.dll 2008-07-30 08:18 . 2008-07-30 08:18 98,304 --a------ F:\WINDOWS\system32\CmdLineExt.dll 2008-07-29 08:56 . 2008-07-29 08:56 479,298 --a------ F:\WINDOWS\system32\wbocx.ocx 2008-07-29 08:56 . 2008-07-29 08:56 172,032 --a------ F:\WINDOWS\system32\AniGIF.ocx 2008-07-29 08:56 . 2008-07-29 08:56 50,688 --a------ F:\WINDOWS\system32\wbhelp2.dll 2008-07-25 16:55 . 2008-07-25 16:55 <DIR> d-------- F:\Documents and Settings\śukasz 2008-07-24 16:36 . 2008-07-24 16:36 <DIR> d-------- F:\Program Files\Logitech 2008-07-24 16:36 . 2008-07-24 16:36 <DIR> d-------- F:\Program Files\Common Files\Logitech 2008-07-23 18:30 . 2008-07-23 18:30 <DIR> d-------- F:\WINDOWS\Sun . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-14 19:13 --------- d--h--w F:\Program Files\InstallShield Installation Information 2008-08-14 13:27 --------- d-----w F:\Program Files\Common Files\InstallShield 2008-07-19 14:13 --------- d-----w F:\Program Files\MediaCoder 2008-07-18 14:52 --------- d-----w F:\Program Files\Windows Media Connect 2 2008-07-16 13:59 223,128 ----a-w F:\WINDOWS\system32\drivers\dtscsi.sys 2008-07-16 13:59 --------- d-----w F:\Program Files\DAEMON Tools 2008-07-16 13:58 96,256 ----a-w F:\WINDOWS\system32\drivers\sptd5197.sys 2008-07-16 13:58 643,072 ----a-w F:\WINDOWS\system32\drivers\sptd.sys 2008-07-16 13:56 --------- d-----w F:\Program Files\Alcohol Soft 2008-07-14 11:38 --------- d-----w F:\Program Files\Dziobas Rar Player 2008-07-07 12:27 --------- d-----w F:\Program Files\K-Lite Codec Pack 2008-07-05 19:58 --------- d-----w F:\Program Files\Sun 2008-07-05 19:57 --------- d-----w F:\Program Files\Java 2008-07-05 19:54 --------- d-----w F:\Program Files\Common Files\Java 2008-07-05 08:51 --------- d-----w F:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks 2008-07-05 08:49 --------- d-----w F:\Program Files\Winamp 2008-07-05 08:49 --------- d-----w F:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar 2008-07-04 21:04 66,872 ----a-w F:\WINDOWS\system32\PnkBstrA.exe 2008-07-04 21:04 22,328 ----a-w F:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-07-04 21:04 107,832 ----a-w F:\WINDOWS\system32\PnkBstrB.exe 2008-07-04 12:16 451,072 ----a-w F:\WINDOWS\Radeon Omega Drivers v3.8.360 Uninstall.exe 2008-07-04 12:16 --------- d-----w F:\Program Files\Radeon Omega Drivers 2008-07-04 12:16 --------- d-----w F:\Program Files\MultiRes 2008-07-03 10:15 --------- d-----w F:\Program Files\Gadu-Gadu 2008-07-03 09:46 --------- d-----w F:\Program Files\Creative 2008-07-03 09:29 --------- d-----w F:\Program Files\microsoft frontpage 2008-07-03 09:28 --------- d-----w F:\Program Files\MSXML 6.0 2008-07-03 09:28 --------- d-----w F:\Program Files\MSXML 4.0 2008-07-03 09:26 --------- d-----w F:\Program Files\Usługi online 2008-05-30 12:19 507,400 ----a-w F:\WINDOWS\system32\XAudio2_1.dll 2008-05-30 12:18 238,088 ----a-w F:\WINDOWS\system32\xactengine3_1.dll 2008-05-30 12:17 65,032 ----a-w F:\WINDOWS\system32\XAPOFX1_0.dll 2008-05-30 12:17 25,608 ----a-w F:\WINDOWS\system32\X3DAudio1_4.dll 2008-05-30 12:11 467,984 ----a-w F:\WINDOWS\system32\d3dx10_38.dll 2008-05-30 12:11 3,850,760 ----a-w F:\WINDOWS\system32\D3DX9_38.dll 2008-05-30 12:11 1,491,992 ----a-w F:\WINDOWS\system32\D3DCompiler_38.dll . ((((((((((((((((((((((((((((( snapshot@2008-08-20_12.37.37.50 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 14:27:04 163,328 ----a-w F:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-08-20 11:16:19 3,338,240 ----a-w F:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-08-20 11:16:19 151,552 ----a-w F:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w F:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-08-20 11:16:15 3,338,240 ----a-w F:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-08-20 11:16:15 151,552 ----a-w F:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="F:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360] "Gadu-Gadu"="C:\Gadu-Gadu\gg.exe" [2005-03-31 11:18 790528] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTSysVol"="F:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 08:13 57344] "UpdReg"="F:\WINDOWS\UpdReg.EXE" [2000-05-10 22:30 90112] "WinampAgent"="F:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352] "SunJavaUpdateSched"="F:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] "DAEMON Tools"="F:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 16:57 133016] "EM_EXEC"="F:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [2002-01-14 09:42 35328] "AtiPTA"="atiptaxx.exe" [2006-02-22 02:05 344064 F:\WINDOWS\system32\atiptaxx.exe] "Resume copy"="copyfstq.exe" [2008-07-30 23:03 73728 F:\WINDOWS\copyfstq.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll "msacm.ac3filter"= ac3filter.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "F:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\Gadu-Gadu\\gg.exe"= "D:\\gry\\PfGamesPoker\\jre\\bin\\javaw.exe"= "D:\\gry\\PointPoker\\jre\\bin\\javaw.exe"= "D:\\BearShare\\BearShare.exe"= "C:\\Program Files\\UOAM\\uoam.exe"= "D:\\totalcmd\\TOTALCMD.EXE"= "E:\\Counter-Strike\\hl.exe"= "C:\\Program Files\\BitLord\\BitLord.exe"= "E:\\DAP\\DAP.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8461:TCP"= 8461:TCP:GoD High Port "8462:TCP"= 8462:TCP:GoD Low Port R3 axvbusx;axvbusx;F:\WINDOWS\system32\DRIVERS\axvbusx.sys [2002-12-27 20:14] R3 axvscsi;axvscsi;F:\WINDOWS\system32\DRIVERS\axvscsi.sys [2002-12-27 20:14] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-20 17:09:36 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . F:\WINDOWS\system32\ati2evxx.exe F:\WINDOWS\system32\ati2evxx.exe F:\WINDOWS\system32\CTSVCCDA.EXE F:\WINDOWS\system32\PnkBstrA.exe F:\WINDOWS\system32\PnkBstrB.exe F:\WINDOWS\system32\MsPMSPSv.exe F:\WINDOWS\system32\wscntfy.exe . ************************************************************************** . Completion time: 2008-08-20 17:11:43 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-20 15:11:37 ComboFix2.txt 2008-08-20 10:37:58 Pre-Run: 168,456,192 bajtów wolnych Post-Run: 163,069,952 bajt˘w wolnych 169

**Posty:** 8001 · przez **Okocza** 20 Sie 2008, 17:18

Wykonaj to co jest podane w tym temacie

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd.