połączenia i viry

**Posty:** 10 · przez **Zathura** 27 Lis 2007, 16:20

Witajcie!
Mam taki problem:
Mam windows XP, SP2 i avasta!
Avast ciagle mi wyskakuje ze próba łączenia jest z jakims servem i sciaga jakis syf ;/, nadodatek co kilka minut wyskakuje mi okienko "windows security alert", pisze ze komputer robi jakies kopie czegos

, zauwazylem tez ze w start -> programy -> autostart pojawiaja sie 2 pliki i nie moge ich wywalic ;/ [pojawiaja sie po wyzuceniu zpowrotem]. Wczesniej mialem gorzej bo mi system sie ciagle zacinal i nic nie moglem zrobic, ale wszedlem w tryb awaryjny i rzeskanowalem Ad-Aware SE Personalem o i wykasowalem wszystko co bylo.

Oto moj log z hijackthis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:19:37, on 2007-11-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\proper.exe C:\WINDOWS\system32\VTTimer.exe C:\WINDOWS\system32\VTtrayp.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Vista Drive Icon\DrvIcon.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\RaConfig.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\proper.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1 O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [DrvIcon] C:\Program Files\Vista Drive Icon\DrvIcon.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Undefined] C:\WINDOWS\system32\winter.exe O4 - HKCU\..\Run: [Undefined] C:\WINDOWS\system32\winter.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: infos.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: autos.exe O4 - Global Startup: RaConfig.lnk = C:\WINDOWS\system32\RaConfig.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - AppInit_DLLs: C:\WINDOWS\system32\sol629.txt O20 - Winlogon Notify: botreg - C:\Documents and Settings\All Users.WINDOWS\Dokumenty\Settings\bot.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- End of file - 4448 bytes

Bardzo prosze o natychmiastowa pomoc i szczeże dziekuje!

**Posty:** 3854 · przez **Dzi@dek** 27 Lis 2007, 16:32

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\proper.exe
O4 - HKLM\..\Run: [Undefined] C:\WINDOWS\system32\winter.exe
O4 - HKCU\..\Run: [Undefined] C:\WINDOWS\system32\winter.exe
O4 - Startup: infos.exe
O4 - Global Startup: autos.exe
O20 - AppInit_DLLs: C:\WINDOWS\system32\sol629.txt
O20 - Winlogon Notify: botreg - C:\Documents and Settings\All Users.WINDOWS\Dokumenty\Settings\bot.dll

Wpisy do usunięcia w Hijackthis, pogrubione ręcznie usuwasz. ( wszystko w awaryjnym po wyłączeniu przywracania systemu.

Nowe logi z Hijackthis oraz ComboFix.

Autor postu otrzymał pochwałę

**Posty:** 10 · przez **Zathura** 27 Lis 2007, 21:52

Wszedlem w tryb awaryjny i skasowalem podane przez ciebei rzeczy, po ponownym przeskanowaniu hijackiem na awaryjnym te rzeczy sie usunely. Lecz jak zalogowalem sie na normalny tryb po przeskanowaniu hijackiem pojawily sie znowu. Jestem troche zielony wiec nie rozumiem co mialo znaczyc te "po wyłączeniu przywracania systemu. "

, uznalem ze jest to mniej wazne i opuscilem to. Moj log z hijacka w normalnym juz trybie:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:49:57, on 2007-11-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.exe C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe C:\WINDOWS\system32\VTTimer.exe C:\WINDOWS\system32\VTtrayp.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Vista Drive Icon\DrvIcon.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Spyware Doctor\SDTrayApp.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\WINDOWS\system32\RaConfig.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Spyware Doctor\svcntaux.exe C:\Program Files\Spyware Doctor\swdsvc.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1 O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [DrvIcon] C:\Program Files\Vista Drive Icon\DrvIcon.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: RaConfig.lnk = C:\WINDOWS\system32\RaConfig.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe -- End of file - 4895 bytes

No i z ComboFixa:

Kod: Zaznacz wszystko: ComboFix 07-11-19.4 - Qba_2 2007-11-27 20:34:51.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.164 [GMT 1:00] Running from: C:\Documents and Settings\Qba_2\Pulpit\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\autos.exe C:\Documents and Settings\LocalService.ZARZ¤DZANIE NT\Dane aplikacji\microsoft\internet explorer\Desktop.htt C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Dane aplikacji\NetMon C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Dane aplikacji\NetMon\domains.txt C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Dane aplikacji\NetMon\log.txt C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Menu Start\Programy\Brave-Sentry C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Menu Start\Programy\Brave-Sentry\BraveSentry.lnk C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Menu Start\Programy\Brave-Sentry\Uninstall.lnk C:\Documents and Settings\Qba_2\Menu Start\Programy\Autostart\infos.exe C:\Documents and Settings\user_2\Menu Start\Programy\Autostart\infos.exe C:\Program Files\bravesentry C:\Program Files\bravesentry\BraveSentry.exe C:\Program Files\bravesentry\BraveSentry.lic C:\Program Files\bravesentry\BraveSentry0.bs C:\Program Files\bravesentry\BraveSentry0.dll C:\Program Files\bravesentry\BraveSentry1.bs C:\Program Files\bravesentry\BraveSentry2.dll C:\Program Files\bravesentry\BraveSentry3.dll C:\Program Files\bravesentry\Uninstall.exe C:\Program Files\network monitor C:\WINDOWS\desktop.html C:\WINDOWS\nwan.dat C:\WINDOWS\system32\6_exception.nls C:\WINDOWS\system32\atmtd.dll C:\WINDOWS\system32\atmtd.dll._ C:\WINDOWS\system32\away.exe.exe C:\WINDOWS\system32\config\47276988.Evt C:\WINDOWS\system32\dllh8jkd1q1.exe C:\WINDOWS\system32\dllh8jkd1q2.exe C:\WINDOWS\system32\dllh8jkd1q5.exe C:\WINDOWS\system32\dllh8jkd1q6.exe C:\WINDOWS\system32\dllh8jkd1q7.exe C:\WINDOWS\system32\dllh8jkd1q8.exe C:\WINDOWS\system32\kernel32.exe C:\WINDOWS\system32\kernelw.sys C:\WINDOWS\system32\kernelwind32.exe C:\WINDOWS\system32\koos.exe C:\WINDOWS\system32\kprof C:\WINDOWS\system32\kr_done1 C:\WINDOWS\system32\max1d11643v.exe C:\WINDOWS\system32\newmaxxsv234.exe C:\WINDOWS\system32\poof C:\WINDOWS\system32\proper.exe C:\WINDOWS\system32\spoolsvv.exe C:\WINDOWS\system32\svcp.csv C:\WINDOWS\system32\vedxg4am1et2.exe C:\WINDOWS\system32\vedxg6ame4.exe C:\WINDOWS\system32\vedxga1me4t1.exe C:\WINDOWS\system32\vedxga3me2.exe C:\WINDOWS\system32\vedxga4m1et4.exe C:\WINDOWS\system32\vedxga4me1.exe C:\WINDOWS\system32\vedxga5me3.exe C:\WINDOWS\system32\vx.tll C:\WINDOWS\system32\winsub.xml C:\WINDOWS\system32\winter.exe C:\WINDOWS\uninstall_nmon.vbs C:\WINDOWS\xpupdate.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_ASC3550P -------\LEGACY_CMDSERVICE -------\LEGACY_DRIVER -------\LEGACY_NETWORK_MONITOR -------\LEGACY_POOF -------\LEGACY_RUNTIME -------\LEGACY_RUNTIME2 -------\asc3550p -------\Driver -------\runtime ((((((((((((((((((((((((( Files Created from 2007-10-27 to 2007-11-27 ))))))))))))))))))))))))))))))) . 2007-11-27 17:58 <DIR> d-------- C:\Documents and Settings\user_2\Dane aplikacji\Talkback 2007-11-27 15:34 <DIR> d-------- C:\Program Files\Spyware Doctor 2007-11-27 15:34 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\PC Tools 2007-11-27 15:34 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-11-27 15:34 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-11-27 15:34 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-11-27 15:34 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-11-27 15:33 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-11-27 15:24 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Lavasoft 2007-11-27 15:04 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Gadu-Gadu 2007-11-27 14:40 <DIR> d-------- C:\Program Files\XoftSpySE 2007-11-27 14:17 20,480 --a------ C:\WINDOWS\davrrx.exe 2007-11-27 14:07 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Talkback 2007-11-27 13:52 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Tibia 2007-11-27 13:51 <DIR> d-------- C:\Documents and Settings\Qba_2\Wapster 2007-11-27 13:42 <DIR> d-------- C:\Documents and Settings\Qba_2\Gadu-Gadu 2007-11-27 13:36 <DIR> d-------- C:\Documents and Settings\user_2\Dane aplikacji\Gadu-Gadu 2007-11-27 13:35 <DIR> d-------- C:\Documents and Settings\user_2\Gadu-Gadu 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\user_2\Ustawienia lokalne 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\user_2\Ulubione 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\user_2\Szablony 2007-11-27 13:31 <DIR> d-------- C:\Documents and Settings\user_2\Pulpit 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\user_2\Moje dokumenty 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\user_2\Menu Start 2007-11-27 13:31 <DIR> dr-h----- C:\Documents and Settings\user_2\Dane aplikacji 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\Qba_2\Ustawienia lokalne 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\Qba_2\Ulubione 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\Qba_2\Szablony 2007-11-27 13:31 <DIR> d-------- C:\Documents and Settings\Qba_2\Pulpit 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\Qba_2\Moje dokumenty 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\Qba_2\Menu Start 2007-11-27 13:31 <DIR> dr-h----- C:\Documents and Settings\Qba_2\Dane aplikacji 2007-11-27 13:28 <DIR> d--h----- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Ustawienia lokalne 2007-11-27 13:28 <DIR> d-------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Ulubione 2007-11-27 13:28 <DIR> d--h----- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Szablony 2007-11-27 13:28 <DIR> d-------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Pulpit 2007-11-27 13:28 <DIR> d-------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Moje dokumenty 2007-11-27 13:28 <DIR> dr------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Menu Start 2007-11-27 13:28 <DIR> dr-h----- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Dane aplikacji 2007-11-27 09:42 <DIR> d-------- C:\Program Files\Lavasoft 2007-11-27 09:25 533,504 --a------ C:\WINDOWS\mmc2.bin 2007-11-27 09:25 533,504 --a------ C:\WINDOWS\mm_tmpc2.bin 2007-11-27 09:25 0 --a------ C:\WINDOWS\mmregalka.exe 2007-11-27 09:24 41,472 --a------ C:\WINDOWS\mm_tmpregalka.exe 2007-11-27 09:23 36,352 --a------ C:\WINDOWS\mmgr.exe 2007-11-27 09:16 <DIR> d--hs---- C:\WINDOWS\dXNlcg 2007-11-27 09:16 <DIR> C:\Documents and Settings\LocalService.ZARZąDZANIE NT\Menu Start 2007-11-27 09:16 <DIR> C:\Documents and Settings\LocalService.ZARZąDZANIE NT\Menu Start 2007-11-27 09:16 81,408 --a------ C:\WINDOWS\mmres_drop.exe 2007-11-27 09:16 45,072 --a------ C:\WINDOWS\taskmon.exe 2007-11-27 09:16 36,352 --a------ C:\WINDOWS\mm_tmpgr.exe 2007-11-27 09:16 12,960 --a------ C:\WINDOWS\system32\taskmon.sys 2007-11-27 09:15 <DIR> d-------- C:\WINDOWS\system32\svcd 2007-11-27 09:15 81,408 --a------ C:\WINDOWS\mm_tmpres_drop.exe 2007-11-27 09:15 41,984 --a------ C:\WINDOWS\ksacre.exe 2007-11-27 09:15 27,648 --a------ C:\WINDOWS\system32\winlogon.scr 2007-11-27 09:15 25,103 --a------ C:\WINDOWS\system32\e2.exe 2007-11-27 09:15 23,552 --a------ C:\WINDOWS\mmall.exe 2007-11-27 09:15 17,285 --a------ C:\WINDOWS\system32\e1.exe 2007-11-27 09:15 136 --a------ C:\WINDOWS\system32\ .bat 2007-11-27 09:15 4 --a------ C:\WINDOWS\system32\SvcNm 2007-11-22 15:43 <DIR> d-------- C:\Program Files\TibiaCam TV Lite 2007-11-22 15:31 <DIR> d-------- C:\Program Files\Trend Micro 2007-11-21 14:42 608,096 --a------ C:\WINDOWS\win32.exe 2007-11-18 08:56 <DIR> d-------- C:\Program Files\Alwil Software 2007-11-18 08:56 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-11-18 08:56 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2007-11-18 08:56 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-11-18 08:56 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-11-16 17:25 <DIR> d-------- C:\Program Files\Belt Generator 2007-11-10 11:24 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Adobe Systems 2007-11-10 11:22 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-11-09 19:18 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2007-11-04 11:35 114,765 --a------ C:\WINDOWS\system32\hpzlnt03.dll 2007-11-04 11:34 376 --a------ C:\WINDOWS\mozregistry.dat 2007-11-04 11:33 <DIR> d-------- C:\Program Files\hp deskjet 845c series 2007-11-04 11:33 <DIR> d-------- C:\Program Files\Hewlett-Packard 2007-11-03 23:25 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2007-11-03 21:13 <DIR> d-------- C:\Program Files\RALINK 2007-11-03 21:13 45,056 --a------ C:\WINDOWS\system32\DEDriverDLL.dll 2007-11-03 21:13 36,864 --a------ C:\WINDOWS\system32\WRLSetup.exe 2007-11-03 21:13 32,768 --a------ C:\WINDOWS\system32\SmartInstallCfg2.dll 2007-11-03 21:08 <DIR> d-------- C:\Program Files\PerfMon3x 2007-11-03 20:56 <DIR> d-------- C:\WINDOWS\SHELLNEW 2007-11-03 20:56 <DIR> d-------- C:\Program Files\Microsoft Works 2007-11-03 20:55 <DIR> d-------- C:\Program Files\Microsoft.NET 2007-11-03 20:52 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-11-03 20:52 115,880 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-11-03 20:49 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\CyberLink 2007-11-03 20:47 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2007-11-03 20:47 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2007-11-03 20:46 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Apple Computer 2007-11-03 20:46 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-11-03 20:46 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-11-03 20:46 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-11-03 20:46 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-11-03 20:46 196,608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-11-03 20:46 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-11-03 20:46 118,784 --a------ C:\WINDOWS\system32\ac3acm.acm 2007-11-03 20:46 73,728 --a------ C:\WINDOWS\system32\dpl100.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-27 08:15 52,828 ----a-w C:\WINDOWS\system32\csaco.exe 2007-11-27 08:15 27,648 --sh--w C:\WINDOWS\system32\drivers\sysdrv.exe 2007-11-18 10:41 --------- d-----w C:\Program Files\Tibia 2007-11-10 10:22 --------- d-----w C:\Program Files\Common Files\Adobe 2007-11-05 06:52 --------- d-----w C:\Program Files\Gadu-Gadu 2007-11-03 20:53 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2007-11-03 20:13 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-03 19:46 --------- d-----w C:\Program Files\K-Lite Codec Pack 2007-11-03 19:45 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll 2007-11-03 19:45 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll 2007-11-03 19:44 --------- d-----w C:\Program Files\Java 2007-11-03 19:43 --------- d-----w C:\Program Files\S3 2007-11-03 19:32 --------- d-----w C:\Program Files\AvRack 2005-07-29 15:24 472 --sha-r C:\WINDOWS\dXNlcg\xrh5w0.vbs . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HDAudDeck"="C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe" [2006-09-29 13:56] "VTTimer"="VTTimer.exe" [2005-03-08 03:33 C:\WINDOWS\system32\VTTimer.exe] "VTTrayp"="VTtrayp.exe" [2005-11-01 04:15 C:\WINDOWS\system32\VTTrayp.exe] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24] "DrvIcon"="C:\Program Files\Vista Drive Icon\DrvIcon.exe" [2007-07-04 20:59] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe" [2001-07-20 11:20] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06] "SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-11-02 17:24] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44] C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26] RaConfig.lnk - C:\WINDOWS\system32\RaConfig.exe [2007-11-03 21:13:27] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "System"="csgfw.exe" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" R0 viamraid;viamraid;C:\WINDOWS\system32\drivers\viamraid.sys R3 RT2400;RT2400 Wireless Driver;C:\WINDOWS\system32\DRIVERS\RT2400.sys S3 taskmon.sys;taskmon.sys;\??\C:\WINDOWS\system32\taskmon.sys *Newly Created Service* - SHAREDACCESS . Contents of the 'Scheduled Tasks' folder "2007-11-27 19:44:26 C:\WINDOWS\Tasks\XoftSpySE 2.job" "2007-11-27 13:40:32 C:\WINDOWS\Tasks\XoftSpySE.job" - C:\Program Files\XoftSpySE\XoftSpy.exe . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-27 20:44:47 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\kprof] "ImagePath"="\??\C:\WINDOWS\system32\kprof" -- [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\poof] "ImagePath"="\??\C:\WINDOWS\system32\poof" -- . Completion time: 2007-11-27 20:46:28 - machine was rebooted . --- E O F ---

Prosilbym nadal Ciebie o pomoc

P.S.
Moze i po wywaleniu w trybie awaryjnym, a moze i nie przestaly sie pokazywac informacje o polaczeniach z trojanami czy czyms takim. Po skanowaniu z ComboFixa pokazala sie ikona na pasku zadan ze mozna zaktualizowac system.

[ Dodano: Dzisiaj o 20:56 ]
Pomylka teraz okazalo sie ze po 2 restartowaniu nie ma juz tych syfów.

**Posty:** 3854 · przez **Dzi@dek** 27 Lis 2007, 23:08

Wyłącz przywracanie systemu - Prawa mysz na mój komputer -> właściwości -> przywracanie systemu -> wyłącz na wszystkich dyskach.

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt + log z hijacka oraz z combofixa (tylko przed uzyciem combo zmien date w komputerze np. na 15.11.2007 zeby byla wczesniejsza niz dzisiejsza data)

**Posty:** 10 · przez **Zathura** 28 Lis 2007, 08:47

Przed tym jak jeszcze napisalem na forum zrobilem nowe konto uzytkownika w windowsie. Teraz wszedlem w C:\Documents and Settings i w stare konto, żeby skopiowac folder gadu-gadu z kontaktami i zuwazylem ze ten syf znowu sie pojawil ;/ [podejzewam, ale tylko podejzewam, ze ten syf zostal na moim starym koncie.

@edit
Zapomnialem wspomniec chyba na poczadku tematu ze nie moglem wchodzic w zadne wlasciwosci ekranu, zmieniac daty oraz w panel sterowania ;/

Po tych 2 restartach i wywaleniu syfow ktore podales zaczelo wszystko dzialac, lecz teraz po tym wejsciu w C:\Documents and Settings znowu nie moge nic zrobic.

Zaraz zrobie wszystko od nowa

[ Dodano: Dzisiaj o 8:16 ]
Po wykasowaniu ręcznym i przez Hijacka zrobilem testy
Hijackthis log:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 08:04:01, on 2007-11-28 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Spyware Doctor\svcntaux.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Spyware Doctor\swdsvc.exe C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe C:\WINDOWS\system32\VTTimer.exe C:\WINDOWS\system32\VTtrayp.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Vista Drive Icon\DrvIcon.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Spyware Doctor\SDTrayApp.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\WINDOWS\system32\RaConfig.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wscntfy.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: (no name) - {D27987B8-7244-4DE0-AE10-39B826B492F1} - C:\WINDOWS\system32\bronto.dll (file missing) O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1 O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [DrvIcon] C:\Program Files\Vista Drive Icon\DrvIcon.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: RaConfig.lnk = C:\WINDOWS\system32\RaConfig.exe O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe -- End of file - 4974 bytes

ComboFix log:

Kod: Zaznacz wszystko: ComboFix 07-11-19.4 - Qba_2 2007-11-28 8:05:27.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.126 [GMT 1:00] Running from: C:\Documents and Settings\Qba_2\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-10-28 to 2007-11-28 ))))))))))))))))))))))))))))))) . 2007-11-28 07:36 <DIR> d-------- C:\Documents and Settings\Qba_2\Gadu-Gadu 2007-11-28 07:25 <DIR> d-------- C:\WINDOWS\ERUNT 2007-11-27 17:58 <DIR> d-------- C:\Documents and Settings\user_2\Dane aplikacji\Talkback 2007-11-27 15:34 <DIR> d-------- C:\Program Files\Spyware Doctor 2007-11-27 15:34 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\PC Tools 2007-11-27 15:34 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-11-27 15:34 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-11-27 15:34 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-11-27 15:34 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-11-27 15:33 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-11-27 15:24 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Lavasoft 2007-11-27 15:04 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Gadu-Gadu 2007-11-27 14:40 <DIR> d-------- C:\Program Files\XoftSpySE 2007-11-27 14:17 20,480 --a------ C:\WINDOWS\davrrx.exe 2007-11-27 14:07 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Talkback 2007-11-27 13:52 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Tibia 2007-11-27 13:51 <DIR> d-------- C:\Documents and Settings\Qba_2\Wapster 2007-11-27 13:36 <DIR> d-------- C:\Documents and Settings\user_2\Dane aplikacji\Gadu-Gadu 2007-11-27 13:35 <DIR> d-------- C:\Documents and Settings\user_2\Gadu-Gadu 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\user_2\Ustawienia lokalne 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\user_2\Ulubione 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\user_2\Szablony 2007-11-27 13:31 <DIR> d-------- C:\Documents and Settings\user_2\Pulpit 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\user_2\Moje dokumenty 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\user_2\Menu Start 2007-11-27 13:31 <DIR> dr-h----- C:\Documents and Settings\user_2\Dane aplikacji 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\Qba_2\Ustawienia lokalne 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\Qba_2\Ulubione 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\Qba_2\Szablony 2007-11-27 13:31 <DIR> d-------- C:\Documents and Settings\Qba_2\Pulpit 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\Qba_2\Moje dokumenty 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\Qba_2\Menu Start 2007-11-27 13:31 <DIR> dr-h----- C:\Documents and Settings\Qba_2\Dane aplikacji 2007-11-27 13:28 <DIR> d--h----- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Ustawienia lokalne 2007-11-27 13:28 <DIR> d-------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Ulubione 2007-11-27 13:28 <DIR> d--h----- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Szablony 2007-11-27 13:28 <DIR> d-------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Pulpit 2007-11-27 13:28 <DIR> d-------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Moje dokumenty 2007-11-27 13:28 <DIR> dr------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Menu Start 2007-11-27 13:28 <DIR> dr-h----- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Dane aplikacji 2007-11-27 09:42 <DIR> d-------- C:\Program Files\Lavasoft 2007-11-27 09:25 533,504 --a------ C:\WINDOWS\mmc2.bin 2007-11-27 09:25 533,504 --a------ C:\WINDOWS\mm_tmpc2.bin 2007-11-27 09:25 0 --a------ C:\WINDOWS\mmregalka.exe 2007-11-27 09:24 41,472 --a------ C:\WINDOWS\mm_tmpregalka.exe 2007-11-27 09:23 36,352 --a------ C:\WINDOWS\mmgr.exe 2007-11-27 09:16 <DIR> d--hs---- C:\WINDOWS\dXNlcg 2007-11-27 09:16 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Menu Start 2007-11-27 09:16 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Menu Start 2007-11-27 09:16 81,408 --a------ C:\WINDOWS\mmres_drop.exe 2007-11-27 09:16 45,072 --a------ C:\WINDOWS\taskmon.exe 2007-11-27 09:16 36,352 --a------ C:\WINDOWS\mm_tmpgr.exe 2007-11-27 09:16 12,960 --a------ C:\WINDOWS\system32\taskmon.sys 2007-11-27 09:15 <DIR> d-------- C:\WINDOWS\system32\svcd 2007-11-27 09:15 81,408 --a------ C:\WINDOWS\mm_tmpres_drop.exe 2007-11-27 09:15 41,984 --a------ C:\WINDOWS\ksacre.exe 2007-11-27 09:15 27,648 --a------ C:\WINDOWS\system32\winlogon.scr 2007-11-27 09:15 25,103 --a------ C:\WINDOWS\system32\e2.exe 2007-11-27 09:15 23,552 --a------ C:\WINDOWS\mmall.exe 2007-11-27 09:15 17,285 --a------ C:\WINDOWS\system32\e1.exe 2007-11-27 09:15 136 --a------ C:\WINDOWS\system32\ .bat 2007-11-27 09:15 4 --a------ C:\WINDOWS\system32\SvcNm 2007-11-22 15:43 <DIR> d-------- C:\Program Files\TibiaCam TV Lite 2007-11-22 15:31 <DIR> d-------- C:\Program Files\Trend Micro 2007-11-18 08:56 <DIR> d-------- C:\Program Files\Alwil Software 2007-11-18 08:56 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-11-18 08:56 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2007-11-18 08:56 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-11-18 08:56 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-11-16 17:25 <DIR> d-------- C:\Program Files\Belt Generator 2007-11-10 11:24 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Adobe Systems 2007-11-10 11:22 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-11-09 19:18 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2007-11-04 11:35 114,765 --a------ C:\WINDOWS\system32\hpzlnt03.dll 2007-11-04 11:34 376 --a------ C:\WINDOWS\mozregistry.dat 2007-11-04 11:33 <DIR> d-------- C:\Program Files\hp deskjet 845c series 2007-11-04 11:33 <DIR> d-------- C:\Program Files\Hewlett-Packard 2007-11-03 23:25 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2007-11-03 21:13 <DIR> d-------- C:\Program Files\RALINK 2007-11-03 21:13 45,056 --a------ C:\WINDOWS\system32\DEDriverDLL.dll 2007-11-03 21:13 36,864 --a------ C:\WINDOWS\system32\WRLSetup.exe 2007-11-03 21:13 32,768 --a------ C:\WINDOWS\system32\SmartInstallCfg2.dll 2007-11-03 21:08 <DIR> d-------- C:\Program Files\PerfMon3x 2007-11-03 20:56 <DIR> d-------- C:\WINDOWS\SHELLNEW 2007-11-03 20:56 <DIR> d-------- C:\Program Files\Microsoft Works 2007-11-03 20:55 <DIR> d-------- C:\Program Files\Microsoft.NET 2007-11-03 20:52 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-11-03 20:52 115,880 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-11-03 20:49 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\CyberLink 2007-11-03 20:47 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2007-11-03 20:47 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2007-11-03 20:46 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Apple Computer 2007-11-03 20:46 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-11-03 20:46 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-11-03 20:46 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-11-03 20:46 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-11-03 20:46 196,608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-11-03 20:46 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-11-03 20:46 118,784 --a------ C:\WINDOWS\system32\ac3acm.acm 2007-11-03 20:46 73,728 --a------ C:\WINDOWS\system32\dpl100.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-27 08:15 52,828 ----a-w C:\WINDOWS\system32\csaco.exe 2007-11-27 08:15 27,648 --sh--w C:\WINDOWS\system32\drivers\sysdrv.exe 2007-11-18 10:41 --------- d-----w C:\Program Files\Tibia 2007-11-10 10:22 --------- d-----w C:\Program Files\Common Files\Adobe 2007-11-05 06:52 --------- d-----w C:\Program Files\Gadu-Gadu 2007-11-03 20:53 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2007-11-03 20:13 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-03 19:46 --------- d-----w C:\Program Files\K-Lite Codec Pack 2007-11-03 19:45 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll 2007-11-03 19:45 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll 2007-11-03 19:44 --------- d-----w C:\Program Files\Java 2007-11-03 19:43 --------- d-----w C:\Program Files\S3 2007-11-03 19:32 --------- d-----w C:\Program Files\AvRack 2005-07-29 15:24 472 --sha-r C:\WINDOWS\dXNlcg\xrh5w0.vbs . ((((((((((((((((((((((((((((( snapshot@2007-11-27_20.45.39.45 ))))))))))))))))))))))))))))))))))))))))) . + 2007-11-23 12:11:56 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2007-11-28 06:25:06 524,288 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2007-11-28 06:25:06 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2007-11-23 12:11:56 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2007-11-28 06:25:05 524,288 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2007-11-28 06:25:05 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat - 2007-11-27 14:35:36 59,576 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-11-27 19:49:07 59,576 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-11-27 14:35:36 75,706 ----a-w C:\WINDOWS\system32\perfc015.dat + 2007-11-27 19:49:07 75,706 ----a-w C:\WINDOWS\system32\perfc015.dat - 2007-11-27 14:35:36 395,336 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-11-27 19:49:07 395,336 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-11-27 14:35:36 451,564 ----a-w C:\WINDOWS\system32\perfh015.dat + 2007-11-27 19:49:07 451,564 ----a-w C:\WINDOWS\system32\perfh015.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HDAudDeck"="C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe" [2006-09-29 13:56] "VTTimer"="VTTimer.exe" [2005-03-08 03:33 C:\WINDOWS\system32\VTTimer.exe] "VTTrayp"="VTtrayp.exe" [2005-11-01 04:15 C:\WINDOWS\system32\VTTrayp.exe] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24] "DrvIcon"="C:\Program Files\Vista Drive Icon\DrvIcon.exe" [2007-07-04 20:59] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe" [2001-07-20 11:20] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06] "SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-11-02 17:24] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44] C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26] RaConfig.lnk - C:\WINDOWS\system32\RaConfig.exe [2007-11-03 21:13:27] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "System"="csgfw.exe" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" R0 viamraid;viamraid;C:\WINDOWS\system32\drivers\viamraid.sys S3 RT2400;RT2400 Wireless Driver;C:\WINDOWS\system32\DRIVERS\RT2400.sys S3 taskmon.sys;taskmon.sys;\??\C:\WINDOWS\system32\taskmon.sys . Contents of the 'Scheduled Tasks' folder "2007-11-28 07:03:37 C:\WINDOWS\Tasks\XoftSpySE 2.job" "2007-11-27 13:40:32 C:\WINDOWS\Tasks\XoftSpySE.job" - C:\Program Files\XoftSpySE\XoftSpy.exe . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-28 08:08:58 Windows 5.1.2600 Dodatek Service Pack 2 NTFS detected NTDLL code modification: ZwClose scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-28 8:10:25 C:\ComboFix2.txt ... 2007-11-27 20:46 . --- E O F ---

Prosze o ponowne zaglądanie na ten temat Dzi@dek

Po skanie z ComboFixa moge grzebać już w panelu sterowania itp.

@edit
Wywalilem konto użytkownika od którego się "zaraził" znowu komputer [ten od którego wziąłem liste kontaktów], nie zatrzymałem plików.

Mam nadzieje, że chociaż troche rozumiesz mnie i dobrze tłumacze.
Pozdrawiam!

**Posty:** 3854 · przez **Dzi@dek** 28 Lis 2007, 11:40

Nie wykonałeś:

Dzi@dek napisał(a):Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt + log z hijacka oraz z combofixa (tylko przed uzyciem combo zmien date w komputerze np. na 15.11.2007 zeby byla wczesniejsza niz dzisiejsza data)

Zastosuj się również w/g tego tematu.
http://forum.programosy.pl/bad-generic-host-process-for-win32-services-vt79489.html

oraz, pobierz program ATFCleaner zaznacz przy przeglądarkach Select All i kliknij w empty selected.

W Hijackthis usuń wpisy:

O2 - BHO: (no name) - {D27987B8-7244-4DE0-AE10-39B826B492F1} - C:\WINDOWS\system32\bronto.dll (file missing)
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

Wyłączyłeś przywracanie systemu :?:

**Posty:** 10 · przez **Zathura** 28 Lis 2007, 15:38

Zastosowałem SDFix, ten link i ATFCleaner i przed każdą operacją właziłem w PPM Moj Komputer -> Właściwości i zmieniałem żeby było wyłączone.
Log z SDFix:

Kod: Zaznacz wszystko: SDFix: Version 1.115 Run by Administrator on 2007-11-28 at 14:16 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-28 14:19:40 Windows 5.1.2600 Dodatek Service Pack 2 NTFS detected NTDLL code modification: ZwClose scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program główny" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- Files with Hidden Attributes: Wed 4 Aug 2004 60,928 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe" Tue 27 Nov 2007 27,648 ..SH. --- "C:\WINDOWS\system32\drivers\sysdrv.exe" Finished!

Log z hijacka:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:36:37, on 2007-11-28 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\VTTimer.exe C:\WINDOWS\system32\VTtrayp.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Vista Drive Icon\DrvIcon.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Spyware Doctor\SDTrayApp.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\WINDOWS\system32\RaConfig.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Spyware Doctor\svcntaux.exe C:\Program Files\Spyware Doctor\swdsvc.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1 O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [DrvIcon] C:\Program Files\Vista Drive Icon\DrvIcon.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: RaConfig.lnk = C:\WINDOWS\system32\RaConfig.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe -- End of file - 4752 bytes

Log z ComboFixa:

Kod: Zaznacz wszystko: ComboFix 07-11-19.4 - Qba_2 2007-11-28 14:25:03.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.146 [GMT 1:00] Running from: C:\Documents and Settings\Qba_2\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-10-28 to 2007-11-28 ))))))))))))))))))))))))))))))) . 2007-11-28 07:36 <DIR> d-------- C:\Documents and Settings\Qba_2\Gadu-Gadu 2007-11-28 07:25 <DIR> d-------- C:\WINDOWS\ERUNT 2007-11-27 17:58 <DIR> d-------- C:\Documents and Settings\user_2\Dane aplikacji\Talkback 2007-11-27 15:34 <DIR> d-------- C:\Program Files\Spyware Doctor 2007-11-27 15:34 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\PC Tools 2007-11-27 15:34 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-11-27 15:34 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-11-27 15:34 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-11-27 15:34 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-11-27 15:33 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-11-27 15:24 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Lavasoft 2007-11-27 15:04 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Gadu-Gadu 2007-11-27 14:40 <DIR> d-------- C:\Program Files\XoftSpySE 2007-11-27 14:17 20,480 --a------ C:\WINDOWS\davrrx.exe 2007-11-27 14:07 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Talkback 2007-11-27 13:52 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Tibia 2007-11-27 13:51 <DIR> d-------- C:\Documents and Settings\Qba_2\Wapster 2007-11-27 13:36 <DIR> d-------- C:\Documents and Settings\user_2\Dane aplikacji\Gadu-Gadu 2007-11-27 13:35 <DIR> d-------- C:\Documents and Settings\user_2\Gadu-Gadu 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\user_2\Ustawienia lokalne 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\user_2\Ulubione 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\user_2\Szablony 2007-11-27 13:31 <DIR> d-------- C:\Documents and Settings\user_2\Pulpit 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\user_2\Moje dokumenty 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\user_2\Menu Start 2007-11-27 13:31 <DIR> dr-h----- C:\Documents and Settings\user_2\Dane aplikacji 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\Qba_2\Ustawienia lokalne 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\Qba_2\Ulubione 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\Qba_2\Szablony 2007-11-27 13:31 <DIR> d-------- C:\Documents and Settings\Qba_2\Pulpit 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\Qba_2\Moje dokumenty 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\Qba_2\Menu Start 2007-11-27 13:31 <DIR> dr-h----- C:\Documents and Settings\Qba_2\Dane aplikacji 2007-11-27 13:28 <DIR> d--h----- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Ustawienia lokalne 2007-11-27 13:28 <DIR> d-------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Ulubione 2007-11-27 13:28 <DIR> d--h----- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Szablony 2007-11-27 13:28 <DIR> d-------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Pulpit 2007-11-27 13:28 <DIR> d-------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Moje dokumenty 2007-11-27 13:28 <DIR> dr------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Menu Start 2007-11-27 13:28 <DIR> dr-h----- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Dane aplikacji 2007-11-27 09:42 <DIR> d-------- C:\Program Files\Lavasoft 2007-11-27 09:25 533,504 --a------ C:\WINDOWS\mmc2.bin 2007-11-27 09:25 533,504 --a------ C:\WINDOWS\mm_tmpc2.bin 2007-11-27 09:25 0 --a------ C:\WINDOWS\mmregalka.exe 2007-11-27 09:24 41,472 --a------ C:\WINDOWS\mm_tmpregalka.exe 2007-11-27 09:23 36,352 --a------ C:\WINDOWS\mmgr.exe 2007-11-27 09:16 <DIR> d--hs---- C:\WINDOWS\dXNlcg 2007-11-27 09:16 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Menu Start 2007-11-27 09:16 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Menu Start 2007-11-27 09:16 81,408 --a------ C:\WINDOWS\mmres_drop.exe 2007-11-27 09:16 45,072 --a------ C:\WINDOWS\taskmon.exe 2007-11-27 09:16 36,352 --a------ C:\WINDOWS\mm_tmpgr.exe 2007-11-27 09:16 12,960 --a------ C:\WINDOWS\system32\taskmon.sys 2007-11-27 09:15 <DIR> d-------- C:\WINDOWS\system32\svcd 2007-11-27 09:15 81,408 --a------ C:\WINDOWS\mm_tmpres_drop.exe 2007-11-27 09:15 41,984 --a------ C:\WINDOWS\ksacre.exe 2007-11-27 09:15 27,648 --a------ C:\WINDOWS\system32\winlogon.scr 2007-11-27 09:15 25,103 --a------ C:\WINDOWS\system32\e2.exe 2007-11-27 09:15 23,552 --a------ C:\WINDOWS\mmall.exe 2007-11-27 09:15 17,285 --a------ C:\WINDOWS\system32\e1.exe 2007-11-27 09:15 136 --a------ C:\WINDOWS\system32\ .bat 2007-11-27 09:15 4 --a------ C:\WINDOWS\system32\SvcNm 2007-11-22 15:43 <DIR> d-------- C:\Program Files\TibiaCam TV Lite 2007-11-22 15:31 <DIR> d-------- C:\Program Files\Trend Micro 2007-11-18 08:56 <DIR> d-------- C:\Program Files\Alwil Software 2007-11-18 08:56 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-11-18 08:56 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2007-11-18 08:56 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-11-18 08:56 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-11-16 17:25 <DIR> d-------- C:\Program Files\Belt Generator 2007-11-10 11:24 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Adobe Systems 2007-11-10 11:22 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-11-09 19:18 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2007-11-04 11:35 114,765 --a------ C:\WINDOWS\system32\hpzlnt03.dll 2007-11-04 11:34 376 --a------ C:\WINDOWS\mozregistry.dat 2007-11-04 11:33 <DIR> d-------- C:\Program Files\hp deskjet 845c series 2007-11-04 11:33 <DIR> d-------- C:\Program Files\Hewlett-Packard 2007-11-03 23:25 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2007-11-03 21:13 <DIR> d-------- C:\Program Files\RALINK 2007-11-03 21:13 45,056 --a------ C:\WINDOWS\system32\DEDriverDLL.dll 2007-11-03 21:13 36,864 --a------ C:\WINDOWS\system32\WRLSetup.exe 2007-11-03 21:13 32,768 --a------ C:\WINDOWS\system32\SmartInstallCfg2.dll 2007-11-03 21:08 <DIR> d-------- C:\Program Files\PerfMon3x 2007-11-03 20:56 <DIR> d-------- C:\WINDOWS\SHELLNEW 2007-11-03 20:56 <DIR> d-------- C:\Program Files\Microsoft Works 2007-11-03 20:55 <DIR> d-------- C:\Program Files\Microsoft.NET 2007-11-03 20:52 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-11-03 20:52 115,880 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-11-03 20:49 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\CyberLink 2007-11-03 20:47 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2007-11-03 20:47 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2007-11-03 20:46 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Apple Computer 2007-11-03 20:46 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-11-03 20:46 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-11-03 20:46 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-11-03 20:46 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-11-03 20:46 196,608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-11-03 20:46 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-11-03 20:46 118,784 --a------ C:\WINDOWS\system32\ac3acm.acm 2007-11-03 20:46 73,728 --a------ C:\WINDOWS\system32\dpl100.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-27 08:15 52,828 ----a-w C:\WINDOWS\system32\csaco.exe 2007-11-27 08:15 27,648 --sh--w C:\WINDOWS\system32\drivers\sysdrv.exe 2007-11-18 10:41 --------- d-----w C:\Program Files\Tibia 2007-11-10 10:22 --------- d-----w C:\Program Files\Common Files\Adobe 2007-11-05 06:52 --------- d-----w C:\Program Files\Gadu-Gadu 2007-11-03 20:53 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2007-11-03 20:13 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-03 19:46 --------- d-----w C:\Program Files\K-Lite Codec Pack 2007-11-03 19:45 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll 2007-11-03 19:45 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll 2007-11-03 19:44 --------- d-----w C:\Program Files\Java 2007-11-03 19:43 --------- d-----w C:\Program Files\S3 2007-11-03 19:32 --------- d-----w C:\Program Files\AvRack 2005-07-29 15:24 472 --sha-r C:\WINDOWS\dXNlcg\xrh5w0.vbs . ((((((((((((((((((((((((((((( snapshot@2007-11-27_20.45.39.45 ))))))))))))))))))))))))))))))))))))))))) . + 2007-11-23 12:11:56 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2007-11-28 13:15:47 548,864 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2007-11-28 13:15:47 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2007-11-23 12:11:56 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2007-11-28 06:25:05 524,288 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2007-11-28 06:25:05 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat - 2007-11-27 14:35:36 59,576 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-11-27 19:49:07 59,576 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-11-27 14:35:36 75,706 ----a-w C:\WINDOWS\system32\perfc015.dat + 2007-11-27 19:49:07 75,706 ----a-w C:\WINDOWS\system32\perfc015.dat - 2007-11-27 14:35:36 395,336 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-11-27 19:49:07 395,336 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-11-27 14:35:36 451,564 ----a-w C:\WINDOWS\system32\perfh015.dat + 2007-11-27 19:49:07 451,564 ----a-w C:\WINDOWS\system32\perfh015.dat + 2007-11-28 13:18:45 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_548.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HDAudDeck"="C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe" [2006-09-29 13:56] "VTTimer"="VTTimer.exe" [2005-03-08 03:33 C:\WINDOWS\system32\VTTimer.exe] "VTTrayp"="VTtrayp.exe" [2005-11-01 04:15 C:\WINDOWS\system32\VTTrayp.exe] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24] "DrvIcon"="C:\Program Files\Vista Drive Icon\DrvIcon.exe" [2007-07-04 20:59] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe" [2001-07-20 11:20] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06] "SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-11-02 17:24] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44] C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26] RaConfig.lnk - C:\WINDOWS\system32\RaConfig.exe [2007-11-03 21:13:27] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "System"="csgfw.exe" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" R0 viamraid;viamraid;C:\WINDOWS\system32\drivers\viamraid.sys R3 RT2400;RT2400 Wireless Driver;C:\WINDOWS\system32\DRIVERS\RT2400.sys S3 taskmon.sys;taskmon.sys;\??\C:\WINDOWS\system32\taskmon.sys . Contents of the 'Scheduled Tasks' folder "2007-11-28 13:18:50 C:\WINDOWS\Tasks\XoftSpySE 2.job" "2007-11-27 13:40:32 C:\WINDOWS\Tasks\XoftSpySE.job" - C:\Program Files\XoftSpySE\XoftSpy.exe . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-28 14:28:28 Windows 5.1.2600 Dodatek Service Pack 2 NTFS detected NTDLL code modification: ZwClose scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-28 14:29:55 C:\ComboFix2.txt ... 2007-11-28 08:10 C:\ComboFix3.txt ... 2007-11-27 20:46 . --- E O F ---

Te wspisy które mi kazałeś uzunąć po wszystkich czynnościach same znikły.
Jeśli to już koniec to powiedz czy zostawić wyłączanie przywracania systemu.
Pozdrawiam!

**Posty:** 3854 · przez **Dzi@dek** 28 Lis 2007, 16:47

Otwórz notatnik i wklej: (

File::
C:\WINDOWS\mmc2.bin
C:\WINDOWS\mm_tmpc2.bin
C:\WINDOWS\mmregalka.exe
C:\WINDOWS\mm_tmpregalka.exe
C:\WINDOWS\mmgr.exe
C:\WINDOWS\dXNlcg
C:\WINDOWS\mmres_drop.exe
C:\WINDOWS\ksacre.exe
C:\WINDOWS\system32\e2.exe
C:\WINDOWS\system32\e1.exe
C:\WINDOWS\system32\ .bat
C:\WINDOWS\mmall.exe
C:\WINDOWS\system32\csaco.exe
C:\WINDOWS\dXNlcg\xrh5w0.vbs

Plik zapisz -> jako -> wszystkie pliki -> pod nazwą CFScript.txt - najlepiej w tym miejscu gdzie masz ikonke Combofix-a.

Przeciągnij zapisany plik na ikonę Combofix-a

Potwierdź >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania.

Przeskanuj on-line http://www.kaspersky.pl/resources/virusscanner/kavwebscan.html

**Posty:** 10 · przez **Zathura** 28 Lis 2007, 18:46

Wywalilem ComboFixem oto log:

Kod: Zaznacz wszystko: ComboFix 07-11-19.4 - Qba_2 2007-11-28 16:24:45.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.178 [GMT 1:00] Running from: C:\Documents and Settings\Qba_2\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Qba_2\Pulpit\CFScript.txt * Created a new restore point FILE C:\WINDOWS\dXNlcg C:\WINDOWS\dXNlcg\xrh5w0.vbs C:\WINDOWS\ksacre.exe C:\WINDOWS\mm_tmpc2.bin C:\WINDOWS\mm_tmpregalka.exe C:\WINDOWS\mmall.exe C:\WINDOWS\mmc2.bin C:\WINDOWS\mmgr.exe C:\WINDOWS\mmregalka.exe C:\WINDOWS\mmres_drop.exe C:\WINDOWS\system32\ .bat C:\WINDOWS\system32\csaco.exe C:\WINDOWS\system32\e1.exe C:\WINDOWS\system32\e2.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\dXNlcg\xrh5w0.vbs C:\WINDOWS\ksacre.exe C:\WINDOWS\mm_tmpc2.bin C:\WINDOWS\mm_tmpregalka.exe C:\WINDOWS\mmall.exe C:\WINDOWS\mmc2.bin C:\WINDOWS\mmgr.exe C:\WINDOWS\mmregalka.exe C:\WINDOWS\mmres_drop.exe C:\WINDOWS\system32\ .bat C:\WINDOWS\system32\csaco.exe C:\WINDOWS\system32\e1.exe C:\WINDOWS\system32\e2.exe . ((((((((((((((((((((((((( Files Created from 2007-10-28 to 2007-11-28 ))))))))))))))))))))))))))))))) . 2007-11-28 07:36 <DIR> d-------- C:\Documents and Settings\Qba_2\Gadu-Gadu 2007-11-28 07:25 <DIR> d-------- C:\WINDOWS\ERUNT 2007-11-27 17:58 <DIR> d-------- C:\Documents and Settings\user_2\Dane aplikacji\Talkback 2007-11-27 15:34 <DIR> d-------- C:\Program Files\Spyware Doctor 2007-11-27 15:34 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\PC Tools 2007-11-27 15:34 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-11-27 15:34 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-11-27 15:34 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-11-27 15:34 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-11-27 15:33 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-11-27 15:24 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Lavasoft 2007-11-27 15:04 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Gadu-Gadu 2007-11-27 14:40 <DIR> d-------- C:\Program Files\XoftSpySE 2007-11-27 14:17 20,480 --a------ C:\WINDOWS\davrrx.exe 2007-11-27 14:07 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Talkback 2007-11-27 13:52 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Tibia 2007-11-27 13:51 <DIR> d-------- C:\Documents and Settings\Qba_2\Wapster 2007-11-27 13:36 <DIR> d-------- C:\Documents and Settings\user_2\Dane aplikacji\Gadu-Gadu 2007-11-27 13:35 <DIR> d-------- C:\Documents and Settings\user_2\Gadu-Gadu 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\user_2\Ustawienia lokalne 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\user_2\Ulubione 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\user_2\Szablony 2007-11-27 13:31 <DIR> d-------- C:\Documents and Settings\user_2\Pulpit 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\user_2\Moje dokumenty 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\user_2\Menu Start 2007-11-27 13:31 <DIR> dr-h----- C:\Documents and Settings\user_2\Dane aplikacji 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\Qba_2\Ustawienia lokalne 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\Qba_2\Ulubione 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\Qba_2\Szablony 2007-11-27 13:31 <DIR> d-------- C:\Documents and Settings\Qba_2\Pulpit 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\Qba_2\Moje dokumenty 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\Qba_2\Menu Start 2007-11-27 13:31 <DIR> dr-h----- C:\Documents and Settings\Qba_2\Dane aplikacji 2007-11-27 13:28 <DIR> d--h----- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Ustawienia lokalne 2007-11-27 13:28 <DIR> d-------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Ulubione 2007-11-27 13:28 <DIR> d--h----- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Szablony 2007-11-27 13:28 <DIR> d-------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Pulpit 2007-11-27 13:28 <DIR> d-------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Moje dokumenty 2007-11-27 13:28 <DIR> dr------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Menu Start 2007-11-27 13:28 <DIR> dr-h----- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Dane aplikacji 2007-11-27 09:42 <DIR> d-------- C:\Program Files\Lavasoft 2007-11-27 09:16 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Menu Start 2007-11-27 09:16 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Menu Start 2007-11-27 09:16 12,960 --a------ C:\WINDOWS\system32\taskmon.sys 2007-11-27 09:15 <DIR> d-------- C:\WINDOWS\system32\svcd 2007-11-27 09:15 27,648 --a------ C:\WINDOWS\system32\winlogon.scr 2007-11-27 09:15 4 --a------ C:\WINDOWS\system32\SvcNm 2007-11-22 15:43 <DIR> d-------- C:\Program Files\TibiaCam TV Lite 2007-11-22 15:31 <DIR> d-------- C:\Program Files\Trend Micro 2007-11-18 08:56 <DIR> d-------- C:\Program Files\Alwil Software 2007-11-18 08:56 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-11-18 08:56 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2007-11-18 08:56 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-11-18 08:56 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-11-16 17:25 <DIR> d-------- C:\Program Files\Belt Generator 2007-11-10 11:24 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Adobe Systems 2007-11-10 11:22 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-11-09 19:18 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2007-11-04 11:33 <DIR> d-------- C:\Program Files\hp deskjet 845c series 2007-11-04 11:33 <DIR> d-------- C:\Program Files\Hewlett-Packard 2007-11-03 23:25 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2007-11-03 21:13 <DIR> d-------- C:\Program Files\RALINK 2007-11-03 21:13 86,016 --a------ C:\WINDOWS\system32\install.dll 2007-11-03 21:13 45,056 --a------ C:\WINDOWS\system32\DEDriverDLL.dll 2007-11-03 21:13 36,864 --a------ C:\WINDOWS\system32\WRLSetup.exe 2007-11-03 21:13 32,768 --a------ C:\WINDOWS\system32\SmartInstallCfg2.dll 2007-11-03 21:08 <DIR> d-------- C:\Program Files\PerfMon3x 2007-11-03 20:56 <DIR> d-------- C:\WINDOWS\SHELLNEW 2007-11-03 20:56 <DIR> d-------- C:\Program Files\Microsoft Works 2007-11-03 20:55 <DIR> d-------- C:\Program Files\Microsoft.NET 2007-11-03 20:52 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-11-03 20:52 115,880 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-11-03 20:49 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\CyberLink 2007-11-03 20:47 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2007-11-03 20:47 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2007-11-03 20:46 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Apple Computer 2007-11-03 20:46 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-11-03 20:46 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-11-03 20:46 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-11-03 20:46 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-11-03 20:46 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-11-03 20:46 118,784 --a------ C:\WINDOWS\system32\ac3acm.acm 2007-11-03 20:46 10,752 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-11-03 20:46 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest 2007-11-03 20:45 1,445,888 --a------ C:\WINDOWS\system32\ac3filter.ax 2007-11-03 20:45 1,415,680 --a------ C:\WINDOWS\system32\WMV9VCM.dll 2007-11-03 20:45 921,600 --a------ C:\WINDOWS\system32\vorbisenc.dll 2007-11-03 20:45 301,568 --a------ C:\WINDOWS\system32\l3codecp.acm 2007-11-03 20:45 237,568 --a------ C:\WINDOWS\system32\OggDS.dll 2007-11-03 20:45 188,416 --a------ C:\WINDOWS\system32\vorbis.dll 2007-11-03 20:45 106,496 --a------ C:\WINDOWS\system32\lmpgspl.ax 2007-11-03 20:45 45,056 --a------ C:\WINDOWS\system32\ogg.dll 2007-11-03 20:44 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-11-03 20:44 77,824 --a------ C:\WINDOWS\system32\xvid.ax 2007-11-03 20:39 171,776 --a--c--- C:\WINDOWS\system32\dllcache\kmixer.sys 2007-11-03 20:39 145,792 --a--c--- C:\WINDOWS\system32\dllcache\portcls.sys 2007-11-03 20:39 130,048 --a------ C:\WINDOWS\system32\ksproxy.ax 2007-11-03 20:39 82,944 --a--c--- C:\WINDOWS\system32\dllcache\wdmaud.sys 2007-11-03 20:39 60,288 --a--c--- C:\WINDOWS\system32\dllcache\drmk.sys 2007-11-03 20:39 52,864 --a--c--- C:\WINDOWS\system32\dllcache\dmusic.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-27 08:59 81,408 ----a-w C:\WINDOWS\mm_tmpres_drop.exe 2007-11-27 08:59 36,352 ----a-w C:\WINDOWS\mm_tmpgr.exe 2007-11-27 08:16 45,072 ----a-w C:\WINDOWS\taskmon.exe 2007-11-27 08:15 27,648 --sh--w C:\WINDOWS\system32\drivers\sysdrv.exe 2007-11-18 10:41 --------- d-----w C:\Program Files\Tibia 2007-11-10 10:22 --------- d-----w C:\Program Files\Common Files\Adobe 2007-11-05 06:52 --------- d-----w C:\Program Files\Gadu-Gadu 2007-11-03 20:53 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2007-11-03 20:13 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-03 19:46 --------- d-----w C:\Program Files\K-Lite Codec Pack 2007-11-03 19:45 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll 2007-11-03 19:45 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll 2007-11-03 19:44 --------- d-----w C:\Program Files\Java 2007-11-03 19:43 --------- d-----w C:\Program Files\S3 2007-11-03 19:32 --------- d-----w C:\Program Files\AvRack . ((((((((((((((((((((((((((((( snapshot@2007-11-27_20.45.39.45 ))))))))))))))))))))))))))))))))))))))))) . + 2007-11-23 12:11:56 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2007-11-28 13:15:47 548,864 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2007-11-28 13:15:47 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2007-11-23 12:11:56 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2007-11-28 06:25:05 524,288 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2007-11-28 06:25:05 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat - 2007-11-27 14:35:36 59,576 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-11-27 19:49:07 59,576 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-11-27 14:35:36 75,706 ----a-w C:\WINDOWS\system32\perfc015.dat + 2007-11-27 19:49:07 75,706 ----a-w C:\WINDOWS\system32\perfc015.dat - 2007-11-27 14:35:36 395,336 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-11-27 19:49:07 395,336 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-11-27 14:35:36 451,564 ----a-w C:\WINDOWS\system32\perfh015.dat + 2007-11-27 19:49:07 451,564 ----a-w C:\WINDOWS\system32\perfh015.dat + 2007-11-28 13:31:50 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_540.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HDAudDeck"="C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe" [2006-09-29 13:56] "VTTimer"="VTTimer.exe" [2005-03-08 03:33 C:\WINDOWS\system32\VTTimer.exe] "VTTrayp"="VTtrayp.exe" [2005-11-01 04:15 C:\WINDOWS\system32\VTTrayp.exe] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24] "DrvIcon"="C:\Program Files\Vista Drive Icon\DrvIcon.exe" [2007-07-04 20:59] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe" [2001-07-20 11:20] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06] "SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-11-02 17:24] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44] C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26] RaConfig.lnk - C:\WINDOWS\system32\RaConfig.exe [2007-11-03 21:13:27] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "System"="csgfw.exe" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" R0 viamraid;viamraid;C:\WINDOWS\system32\drivers\viamraid.sys R3 RT2400;RT2400 Wireless Driver;C:\WINDOWS\system32\DRIVERS\RT2400.sys S3 taskmon.sys;taskmon.sys;\??\C:\WINDOWS\system32\taskmon.sys . Contents of the 'Scheduled Tasks' folder "2007-11-28 13:31:50 C:\WINDOWS\Tasks\XoftSpySE 2.job" "2007-11-27 13:40:32 C:\WINDOWS\Tasks\XoftSpySE.job" - C:\Program Files\XoftSpySE\XoftSpy.exe . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-28 16:28:49 Windows 5.1.2600 Dodatek Service Pack 2 NTFS detected NTDLL code modification: ZwClose scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-28 16:30:14 C:\ComboFix2.txt ... 2007-11-28 14:29 C:\ComboFix3.txt ... 2007-11-28 08:10 . --- E O F ---

Przeskanowałem również online i wykrylo 23 wirusy i 53 zainfekowanych objektow. zapisalem raport oto on:

Kod: Zaznacz wszystko: KASPERSKY ONLINE SCANNER REPORT 28 listopad 2007 17:40:15 System operacyjny: Microsoft Windows XP Professional, Dodatek Service Pack 2 (Build 2600) Kaspersky Online Scanner wersja: 5.0.98.0 Ostatnia aktualizacja Kaspersky Anti-Virus28/11/2007 Liczba wpisów w bazie danych Kaspersky Anti-Virus467732 Ustawienia skanowania Skanowanie przy użyciu następujących baz danych rozszerzone Skanuj archiwa tak Skanuj pocztowe bazy danych tak Obszar skanowania Mój komputer A:\ C:\ D:\ E:\ Statystyki skanowania Liczba skanowanych obiektów 49323 Liczba wykrytych wirusów 23 Liczba zainfekowanych obiektów 53 Liczba podejrzanych obiektów 0 Czas trwania skanowania 00:41:12 Nazwa zainfekowanego obiektu Nazwa wirusa Ostatnie działanie C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Cookies\index.dat Object is locked pominięty C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\NTUSER.DAT Object is locked pominięty C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\ntuser.dat.LOG Object is locked pominięty C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Ustawienia lokalne\Historia\History.IE5\index.dat Object is locked pominięty C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT\Cookies\index.dat Object is locked pominięty C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT\NTUSER.DAT Object is locked pominięty C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT\ntuser.dat.LOG Object is locked pominięty C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT\Ustawienia lokalne\Historia\History.IE5\index.dat Object is locked pominięty C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty C:\Documents and Settings\Qba\Pulpit\Wygląd\Mega skiny\Vista_2_4.rar/Vista 2.4/LS Patch/LSPatch.exe/WISE0004.BIN Zainfekowanych: not-a-virus:RiskTool.Win32.CloseApp.a pominięty C:\Documents and Settings\Qba\Pulpit\Wygląd\Mega skiny\Vista_2_4.rar/Vista 2.4/LS Patch/LSPatch.exe Zainfekowanych: not-a-virus:RiskTool.Win32.CloseApp.a pominięty C:\Documents and Settings\Qba\Pulpit\Wygląd\Mega skiny\Vista_2_4.rar RAR: zainfekowany - 2 pominięty C:\Documents and Settings\Qba_2\Cookies\index.dat Object is locked pominięty C:\Documents and Settings\Qba_2\Dane aplikacji\Mozilla\Firefox\Profiles\am4v1oyz.default\Cache\_CACHE_001_ Object is locked pominięty C:\Documents and Settings\Qba_2\Dane aplikacji\Mozilla\Firefox\Profiles\am4v1oyz.default\Cache\_CACHE_002_ Object is locked pominięty C:\Documents and Settings\Qba_2\Dane aplikacji\Mozilla\Firefox\Profiles\am4v1oyz.default\Cache\_CACHE_003_ Object is locked pominięty C:\Documents and Settings\Qba_2\Dane aplikacji\Mozilla\Firefox\Profiles\am4v1oyz.default\Cache\_CACHE_MAP_ Object is locked pominięty C:\Documents and Settings\Qba_2\Dane aplikacji\Mozilla\Firefox\Profiles\am4v1oyz.default\formhistory.dat Object is locked pominięty C:\Documents and Settings\Qba_2\Dane aplikacji\Mozilla\Firefox\Profiles\am4v1oyz.default\history.dat Object is locked pominięty C:\Documents and Settings\Qba_2\Dane aplikacji\Mozilla\Firefox\Profiles\am4v1oyz.default\parent.lock Object is locked pominięty C:\Documents and Settings\Qba_2\Moje dokumenty\Wygląd\Mega skiny\Vista_2_4.rar/Vista 2.4/LS Patch/LSPatch.exe/WISE0004.BIN Zainfekowanych: not-a-virus:RiskTool.Win32.CloseApp.a pominięty C:\Documents and Settings\Qba_2\Moje dokumenty\Wygląd\Mega skiny\Vista_2_4.rar/Vista 2.4/LS Patch/LSPatch.exe Zainfekowanych: not-a-virus:RiskTool.Win32.CloseApp.a pominięty C:\Documents and Settings\Qba_2\Moje dokumenty\Wygląd\Mega skiny\Vista_2_4.rar RAR: zainfekowany - 2 pominięty C:\Documents and Settings\Qba_2\NTUSER.DAT Object is locked pominięty C:\Documents and Settings\Qba_2\ntuser.dat.LOG Object is locked pominięty C:\Documents and Settings\Qba_2\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty C:\Documents and Settings\Qba_2\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty C:\Documents and Settings\Qba_2\Ustawienia lokalne\Historia\History.IE5\index.dat Object is locked pominięty C:\Documents and Settings\Qba_2\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty C:\Program Files\Adobe\Adobe Bridge\install.adb Object is locked pominięty C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked pominięty C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked pominięty C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int Object is locked pominięty C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked pominięty C:\qoobox\Quarantine\C\Program Files\BraveSentry\BraveSentry.exe.vir Zainfekowanych: not-a-virus:FraudTool.Win32.BraveSentry.b pominięty C:\qoobox\Quarantine\C\Program Files\BraveSentry\BraveSentry0.dll.vir Zainfekowanych: not-a-virus:FraudTool.Win32.BraveSentry.b pominięty C:\qoobox\Quarantine\C\Program Files\BraveSentry\BraveSentry2.dll.vir Zainfekowanych: not-a-virus:FraudTool.Win32.BraveSentry.b pominięty C:\qoobox\Quarantine\C\Program Files\BraveSentry\BraveSentry3.dll.vir Zainfekowanych: not-a-virus:FraudTool.Win32.BraveSentry.b pominięty C:\qoobox\Quarantine\C\WINDOWS\desktop.html.vir Zainfekowanych: not-virus:Hoax.Win32.Renos.cy pominięty C:\qoobox\Quarantine\C\WINDOWS\ksacre.exe.vir Zainfekowanych: Trojan-Proxy.Win32.Wopla.ao pominięty C:\qoobox\Quarantine\C\WINDOWS\mmall.exe.vir Zainfekowanych: Trojan-Proxy.Win32.Wopla.ac pominięty C:\qoobox\Quarantine\C\WINDOWS\mm_tmpregalka.exe.vir Zainfekowanych: Trojan-Downloader.Win32.Agent.fip pominięty C:\qoobox\Quarantine\C\WINDOWS\nwan.dat.vir Zainfekowanych: Trojan-Proxy.Win32.Agent.nu pominięty C:\qoobox\Quarantine\C\WINDOWS\system32\away.exe.exe.vir Zainfekowanych: Email-Worm.Win32.Zhelatin.my pominięty C:\qoobox\Quarantine\C\WINDOWS\system32\config\47276988.Evt.vir Zainfekowanych: Trojan.Win32.KillAV.lz pominięty C:\qoobox\Quarantine\C\WINDOWS\system32\csaco.exe.vir Zainfekowanych: Trojan-Downloader.Win32.Agent.uj pominięty C:\qoobox\Quarantine\C\WINDOWS\system32\e1.exe.vir Zainfekowanych: Packed.Win32.Tibs.dm pominięty C:\qoobox\Quarantine\C\WINDOWS\system32\e2.exe.vir Zainfekowanych: Trojan-Downloader.Win32.Small.buy pominięty C:\qoobox\Quarantine\C\WINDOWS\system32\kernelwind32.exe.vir Zainfekowanych: Packed.Win32.Tibs.dm pominięty C:\qoobox\Quarantine\C\WINDOWS\system32\max1d11643v.exe.vir Zainfekowanych: not-a-virus:Porn-Dialer.Win32.GBDialer.j pominięty C:\qoobox\Quarantine\C\WINDOWS\system32\spoolsvv.exe.vir Zainfekowanych: Trojan-Proxy.Win32.Agent.ry pominięty C:\qoobox\Quarantine\C\WINDOWS\system32\vedxga4m1et4.exe.vir Zainfekowanych: Trojan-Proxy.Win32.Agent.rs pominięty C:\qoobox\Quarantine\C\WINDOWS\system32\vedxga4me1.exe.vir Zainfekowanych: Trojan-Proxy.Win32.Xorpix.cm pominięty C:\qoobox\Quarantine\C\WINDOWS\system32\vedxga5me3.exe.vir Zainfekowanych: Trojan-Downloader.Win32.Small.guf pominięty C:\qoobox\Quarantine\catchme2007-11-27_204435.23.zip/kernelw.sys Zainfekowanych: Packed.Win32.Tibs.ap pominięty C:\qoobox\Quarantine\catchme2007-11-27_204435.23.zip/kprof Zainfekowanych: Trojan-Proxy.Win32.Wopla.ag pominięty C:\qoobox\Quarantine\catchme2007-11-27_204435.23.zip/koos.exe Zainfekowanych: Trojan-Proxy.Win32.Wopla.ag pominięty C:\qoobox\Quarantine\catchme2007-11-27_204435.23.zip/poof Zainfekowanych: Trojan-Proxy.Win32.Wopla.ag pominięty C:\qoobox\Quarantine\catchme2007-11-27_204435.23.zip ZIP: zainfekowany - 4 pominięty C:\SDFix\backups_old1\HOSTS Zainfekowanych: Trojan.Win32.Qhost.mg pominięty C:\SDFix\backups_old2\backups.zip/backups/bot.dll Zainfekowanych: Trojan-Proxy.Win32.Xorpix.cm pominięty C:\SDFix\backups_old2\backups.zip/backups/win32.exe Zainfekowanych: Trojan-PSW.Win32.Tibia.co pominięty C:\SDFix\backups_old2\backups.zip ZIP: zainfekowany - 2 pominięty C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked pominięty C:\System Volume Information\_restore{3531A0DA-1A75-4A3E-A311-C3C4B82C9AC9}\RP22\A0063453.exe Zainfekowanych: not-a-virus:RiskTool.Win32.CloseApp.a pominięty C:\System Volume Information\_restore{3531A0DA-1A75-4A3E-A311-C3C4B82C9AC9}\RP22\A0063459.exe Zainfekowanych: not-a-virus:RiskTool.Win32.CloseApp.a pominięty C:\System Volume Information\_restore{3531A0DA-1A75-4A3E-A311-C3C4B82C9AC9}\RP22\A0063530.exe/WISE0005.BIN Zainfekowanych: not-a-virus:RiskTool.Win32.CloseApp.a pominięty C:\System Volume Information\_restore{3531A0DA-1A75-4A3E-A311-C3C4B82C9AC9}\RP22\A0063530.exe WiseSFX: zainfekowany - 1 pominięty C:\System Volume Information\_restore{3531A0DA-1A75-4A3E-A311-C3C4B82C9AC9}\RP22\A0063533.exe Zainfekowanych: not-a-virus:RiskTool.Win32.CloseApp.a pominięty C:\System Volume Information\_restore{3531A0DA-1A75-4A3E-A311-C3C4B82C9AC9}\RP22\A0063570.exe Zainfekowanych: not-a-virus:RiskTool.Win32.CloseApp.a pominięty C:\System Volume Information\_restore{3531A0DA-1A75-4A3E-A311-C3C4B82C9AC9}\RP22\A0063647.exe/WISE0005.BIN Zainfekowanych: not-a-virus:RiskTool.Win32.CloseApp.a pominięty C:\System Volume Information\_restore{3531A0DA-1A75-4A3E-A311-C3C4B82C9AC9}\RP22\A0063647.exe WiseSFX: zainfekowany - 1 pominięty C:\System Volume Information\_restore{3531A0DA-1A75-4A3E-A311-C3C4B82C9AC9}\RP22\A0067667.exe/WISE0039.BIN Zainfekowanych: not-a-virus:RiskTool.Win32.CloseApp.a pominięty C:\System Volume Information\_restore{3531A0DA-1A75-4A3E-A311-C3C4B82C9AC9}\RP22\A0067667.exe/WISE0058.BIN/WISE0005.BIN Zainfekowanych: not-a-virus:RiskTool.Win32.CloseApp.a pominięty C:\System Volume Information\_restore{3531A0DA-1A75-4A3E-A311-C3C4B82C9AC9}\RP22\A0067667.exe/WISE0058.BIN Zainfekowanych: not-a-virus:RiskTool.Win32.CloseApp.a pominięty C:\System Volume Information\_restore{3531A0DA-1A75-4A3E-A311-C3C4B82C9AC9}\RP22\A0067667.exe WiseSFX: zainfekowany - 3 pominięty C:\System Volume Information\_restore{3531A0DA-1A75-4A3E-A311-C3C4B82C9AC9}\RP25\A0075099.exe/WISE0004.BIN Zainfekowanych: not-a-virus:RiskTool.Win32.CloseApp.a pominięty C:\System Volume Information\_restore{3531A0DA-1A75-4A3E-A311-C3C4B82C9AC9}\RP25\A0075099.exe WiseSFX: zainfekowany - 1 pominięty C:\WINDOWS\davrrx.exe Zainfekowanych: Trojan-Downloader.Win32.Agent.fke pominięty C:\WINDOWS\Debug\PASSWD.LOG Object is locked pominięty C:\WINDOWS\SchedLgU.Txt Object is locked pominięty C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked pominięty C:\WINDOWS\system32\CatRoot2\edb.log Object is locked pominięty C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked pominięty C:\WINDOWS\system32\config\Antivirus.Evt Object is locked pominięty C:\WINDOWS\system32\config\AppEvent.Evt Object is locked pominięty C:\WINDOWS\system32\config\default Object is locked pominięty C:\WINDOWS\system32\config\default.LOG Object is locked pominięty C:\WINDOWS\system32\config\SAM Object is locked pominięty C:\WINDOWS\system32\config\SAM.LOG Object is locked pominięty C:\WINDOWS\system32\config\SecEvent.Evt Object is locked pominięty C:\WINDOWS\system32\config\SECURITY Object is locked pominięty C:\WINDOWS\system32\config\SECURITY.LOG Object is locked pominięty C:\WINDOWS\system32\config\software Object is locked pominięty C:\WINDOWS\system32\config\software.LOG Object is locked pominięty C:\WINDOWS\system32\config\SysEvent.Evt Object is locked pominięty C:\WINDOWS\system32\config\system Object is locked pominięty C:\WINDOWS\system32\config\system.LOG Object is locked pominięty C:\WINDOWS\system32\h323log.txt Object is locked pominięty C:\WINDOWS\system32\lobsg.exe Zainfekowanych: Trojan.Win32.DNSChanger.hd pominięty C:\WINDOWS\system32\taskmon.sys Zainfekowanych: Trojan-Proxy.Win32.Agent.rs pominięty C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked pominięty C:\WINDOWS\taskmon.exe Zainfekowanych: Trojan-Proxy.Win32.Agent.rs pominięty C:\WINDOWS\Temp\Perflib_Perfdata_558.dat Object is locked pominięty C:\WINDOWS\WindowsUpdate.log Object is locked pominięty D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked pominięty Proces skanowania został zakończony.

Nie wiem czy to dobrze wygląda ten log z skanera, ale raport był w rozszeżeniu html i nie mialem zbyt wilkiego pola do manewru.
Odpowiedz!

[ Dodano: Dzisiaj o 17:48 ]
Aha i kiedy probowalem przeslac raport czy wykaz z tego skanera online to pisalo "Wybrano zainfekowane lub złożone pliki [...]Aby wyslac pliki do firmy Kaspersky Lab należy wybrać pliki podejżane[...]"

**Posty:** 3854 · przez **Dzi@dek** 28 Lis 2007, 19:39

Sprawdź te przywracanie systemu ( okienko powinno być zaptaszkowane )

W notatniku wklej:

File::
C:\WINDOWS\davrrx.exe
C:\WINDOWS\system32\winlogon.scr
C:\WINDOWS\system32\taskmon.sys
C:\WINDOWS\system32\drivers\sysdrv.exe
C:\WINDOWS\taskmon.exe

Folder::
C:\WINDOWS\system32\svcd
C:\WINDOWS\system32\SvcNm

Driver::
taskmon

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windowsnt\currentversion\winlogon]
"System"=-

Plik zapisz -> jako -> wszystkie pliki -> pod nazwą CFScript.txt - najlepiej w tym miejscu gdzie masz ikonke Combofix-a.

Przeciągnij zapisany plik na ikonę Combofix-a ( jak poprzednio )

Daj loga z Combo - później możesz usunąć katalogi
C:\qoobox
C:\SDFix

**Posty:** 10 · przez **Zathura** 28 Lis 2007, 20:01

to ktore do notatnika dac?

**Posty:** 3854 · przez **Dzi@dek** 28 Lis 2007, 20:03

całość w cytacie:

Dzi@dek napisał(a):File::
C:\WINDOWS\davrrx.exe
C:\WINDOWS\system32\winlogon.scr
C:\WINDOWS\system32\taskmon.sys
C:\WINDOWS\system32\drivers\sysdrv.exe
C:\WINDOWS\taskmon.exe

Folder::
C:\WINDOWS\system32\svcd
C:\WINDOWS\system32\SvcNm

Driver::
taskmon

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windowsnt\currentversion\winlogon]
"System"=-

**Posty:** 10 · przez **Zathura** 28 Lis 2007, 20:09

Za kazdym razem kiedy robie cos na combofixie to w wlasciwosciach mojego komputera jest wlaczone przywracanie systemu. [Ciagle poprawiam]

OK wiec dodalem to do notatnika i oto log:

Kod: Zaznacz wszystko: ComboFix 07-11-19.4 - Qba_2 2007-11-28 19:05:10.6 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.185 [GMT 1:00] Running from: C:\Documents and Settings\Qba_2\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Qba_2\Pulpit\CFScript.txt * Created a new restore point FILE C:\WINDOWS\davrrx.exe C:\WINDOWS\system32\drivers\sysdrv.exe C:\WINDOWS\system32\taskmon.sys C:\WINDOWS\system32\winlogon.scr C:\WINDOWS\taskmon.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\drivers\sysdrv.exe C:\WINDOWS\system32\svcd C:\WINDOWS\system32\SvcNm\ C:\WINDOWS\system32\taskmon.sys C:\WINDOWS\system32\winlogon.scr C:\WINDOWS\taskmon.exe . ((((((((((((((((((((((((( Files Created from 2007-10-28 to 2007-11-28 ))))))))))))))))))))))))))))))) . 2007-11-28 16:33 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-11-28 16:33 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Kaspersky Lab 2007-11-28 07:36 <DIR> d-------- C:\Documents and Settings\Qba_2\Gadu-Gadu 2007-11-28 07:25 <DIR> d-------- C:\WINDOWS\ERUNT 2007-11-27 17:58 <DIR> d-------- C:\Documents and Settings\user_2\Dane aplikacji\Talkback 2007-11-27 15:34 <DIR> d-------- C:\Program Files\Spyware Doctor 2007-11-27 15:34 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\PC Tools 2007-11-27 15:34 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-11-27 15:34 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-11-27 15:34 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-11-27 15:34 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-11-27 15:33 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-11-27 15:24 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Lavasoft 2007-11-27 15:04 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Gadu-Gadu 2007-11-27 14:07 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Talkback 2007-11-27 13:52 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Tibia 2007-11-27 13:51 <DIR> d-------- C:\Documents and Settings\Qba_2\Wapster 2007-11-27 13:36 <DIR> d-------- C:\Documents and Settings\user_2\Dane aplikacji\Gadu-Gadu 2007-11-27 13:35 <DIR> d-------- C:\Documents and Settings\user_2\Gadu-Gadu 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\user_2\Ustawienia lokalne 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\user_2\Ulubione 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\user_2\Szablony 2007-11-27 13:31 <DIR> d-------- C:\Documents and Settings\user_2\Pulpit 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\user_2\Moje dokumenty 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\user_2\Menu Start 2007-11-27 13:31 <DIR> dr-h----- C:\Documents and Settings\user_2\Dane aplikacji 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\Qba_2\Ustawienia lokalne 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\Qba_2\Ulubione 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\Qba_2\Szablony 2007-11-27 13:31 <DIR> d-------- C:\Documents and Settings\Qba_2\Pulpit 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\Qba_2\Moje dokumenty 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\Qba_2\Menu Start 2007-11-27 13:31 <DIR> dr-h----- C:\Documents and Settings\Qba_2\Dane aplikacji 2007-11-27 13:28 <DIR> d--h----- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Ustawienia lokalne 2007-11-27 13:28 <DIR> d-------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Ulubione 2007-11-27 13:28 <DIR> d--h----- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Szablony 2007-11-27 13:28 <DIR> d-------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Pulpit 2007-11-27 13:28 <DIR> d-------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Moje dokumenty 2007-11-27 13:28 <DIR> dr------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Menu Start 2007-11-27 13:28 <DIR> dr-h----- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Dane aplikacji 2007-11-27 09:42 <DIR> d-------- C:\Program Files\Lavasoft 2007-11-27 09:16 <DIR> d--hs---- C:\WINDOWS\dXNlcg 2007-11-27 09:16 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Menu Start 2007-11-27 09:16 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Menu Start 2007-11-27 09:15 4 --a------ C:\WINDOWS\system32\SvcNm 2007-11-22 15:43 <DIR> d-------- C:\Program Files\TibiaCam TV Lite 2007-11-22 15:31 <DIR> d-------- C:\Program Files\Trend Micro 2007-11-18 08:56 <DIR> d-------- C:\Program Files\Alwil Software 2007-11-18 08:56 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2007-11-18 08:56 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-11-18 08:56 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-11-10 11:24 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Adobe Systems 2007-11-10 11:22 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-11-09 19:18 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2007-11-04 11:34 376 --a------ C:\WINDOWS\mozregistry.dat 2007-11-04 11:33 <DIR> d-------- C:\Program Files\hp deskjet 845c series 2007-11-04 11:33 <DIR> d-------- C:\Program Files\Hewlett-Packard 2007-11-03 23:25 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2007-11-03 21:13 <DIR> d-------- C:\Program Files\RALINK 2007-11-03 21:13 86,016 --a------ C:\WINDOWS\system32\install.dll 2007-11-03 21:13 45,056 --a------ C:\WINDOWS\system32\DEDriverDLL.dll 2007-11-03 21:13 36,864 --a------ C:\WINDOWS\system32\WRLSetup.exe 2007-11-03 21:13 32,768 --a------ C:\WINDOWS\system32\SmartInstallCfg2.dll 2007-11-03 21:08 <DIR> d-------- C:\Program Files\PerfMon3x 2007-11-03 20:56 <DIR> d-------- C:\WINDOWS\SHELLNEW 2007-11-03 20:56 <DIR> d-------- C:\Program Files\Microsoft Works 2007-11-03 20:55 <DIR> d-------- C:\Program Files\Microsoft.NET 2007-11-03 20:52 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-11-03 20:52 115,880 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-11-03 20:49 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\CyberLink 2007-11-03 20:47 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2007-11-03 20:47 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2007-11-03 20:46 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Apple Computer 2007-11-03 20:46 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-11-03 20:46 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-11-03 20:46 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-11-03 20:46 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-11-03 20:46 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-11-03 20:46 10,752 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-11-03 20:46 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest 2007-11-03 20:45 1,415,680 --a------ C:\WINDOWS\system32\WMV9VCM.dll 2007-11-03 20:45 921,600 --a------ C:\WINDOWS\system32\vorbisenc.dll 2007-11-03 20:45 301,568 --a------ C:\WINDOWS\system32\l3codecp.acm 2007-11-03 20:45 237,568 --a------ C:\WINDOWS\system32\OggDS.dll 2007-11-03 20:45 188,416 --a------ C:\WINDOWS\system32\vorbis.dll 2007-11-03 20:45 106,496 --a------ C:\WINDOWS\system32\lmpgspl.ax 2007-11-03 20:45 45,056 --a------ C:\WINDOWS\system32\ogg.dll 2007-11-03 20:44 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-11-03 20:44 77,824 --a------ C:\WINDOWS\system32\xvid.ax 2007-11-03 20:39 171,776 --a--c--- C:\WINDOWS\system32\dllcache\kmixer.sys 2007-11-03 20:39 145,792 --a--c--- C:\WINDOWS\system32\dllcache\portcls.sys 2007-11-03 20:39 130,048 --a------ C:\WINDOWS\system32\ksproxy.ax 2007-11-03 20:39 82,944 --a--c--- C:\WINDOWS\system32\dllcache\wdmaud.sys 2007-11-03 20:39 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys 2007-11-03 20:39 60,288 --a--c--- C:\WINDOWS\system32\dllcache\drmk.sys 2007-11-03 20:39 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys 2007-11-03 20:39 52,864 --a--c--- C:\WINDOWS\system32\dllcache\dmusic.sys 2007-11-03 20:39 6,400 --a--c--- C:\WINDOWS\system32\dllcache\splitter.sys 2007-11-03 20:39 5,376 --a--c--- C:\WINDOWS\system32\dllcache\mspclock.sys 2007-11-03 20:39 4,992 --a--c--- C:\WINDOWS\system32\dllcache\mspqm.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-18 10:41 --------- d-----w C:\Program Files\Tibia 2007-11-10 10:22 --------- d-----w C:\Program Files\Common Files\Adobe 2007-11-05 06:52 --------- d-----w C:\Program Files\Gadu-Gadu 2007-11-03 20:53 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2007-11-03 20:13 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-03 19:46 --------- d-----w C:\Program Files\K-Lite Codec Pack 2007-11-03 19:45 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll 2007-11-03 19:45 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll 2007-11-03 19:44 --------- d-----w C:\Program Files\Java 2007-11-03 19:43 --------- d-----w C:\Program Files\S3 2007-11-03 19:32 --------- d-----w C:\Program Files\AvRack . ((((((((((((((((((((((((((((( snapshot@2007-11-27_20.45.39.45 ))))))))))))))))))))))))))))))))))))))))) . + 2007-11-23 12:11:56 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2007-11-28 13:15:47 548,864 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2007-11-28 13:15:47 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2007-11-23 12:11:56 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2007-11-28 06:25:05 524,288 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2007-11-28 06:25:05 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat + 2005-05-24 11:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll + 2007-08-29 14:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe + 2007-08-29 14:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll - 2007-11-27 14:35:36 59,576 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-11-27 19:49:07 59,576 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-11-27 14:35:36 75,706 ----a-w C:\WINDOWS\system32\perfc015.dat + 2007-11-27 19:49:07 75,706 ----a-w C:\WINDOWS\system32\perfc015.dat - 2007-11-27 14:35:36 395,336 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-11-27 19:49:07 395,336 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-11-27 14:35:36 451,564 ----a-w C:\WINDOWS\system32\perfh015.dat + 2007-11-27 19:49:07 451,564 ----a-w C:\WINDOWS\system32\perfh015.dat + 2007-11-28 17:49:08 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_550.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HDAudDeck"="C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe" [2006-09-29 13:56] "VTTimer"="VTTimer.exe" [2005-03-08 03:33 C:\WINDOWS\system32\VTTimer.exe] "VTTrayp"="VTtrayp.exe" [2005-11-01 04:15 C:\WINDOWS\system32\VTTrayp.exe] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24] "DrvIcon"="C:\Program Files\Vista Drive Icon\DrvIcon.exe" [2007-07-04 20:59] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe" [2001-07-20 11:20] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44] C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26] RaConfig.lnk - C:\WINDOWS\system32\RaConfig.exe [2007-11-03 21:13:27] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "System"="csgfw.exe" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" R0 viamraid;viamraid;C:\WINDOWS\system32\drivers\viamraid.sys R3 RT2400;RT2400 Wireless Driver;C:\WINDOWS\system32\DRIVERS\RT2400.sys S3 taskmon.sys;taskmon.sys;\??\C:\WINDOWS\system32\taskmon.sys . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-28 19:06:33 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-28 19:07:05 C:\ComboFix2.txt ... 2007-11-28 18:59 C:\ComboFix3.txt ... 2007-11-28 16:30 . --- E O F ---

[ Dodano: Dzisiaj o 19:12 ]
zauwazylem tez ze po wykasowywaniu poprzez combofixa tych danych ktore mi napisales co raz kiedy wlaczam gadugadu pojawia sie komunikat czy nadal blokowac czy odblokowac gg. taki alert zapory czy cos w tym stylu, nie wiem czy zrorumiesz...

**Posty:** 18165 · przez **wojtas** 28 Lis 2007, 20:13

Start => Uruchom => cmd =>

sc stop taskmon.sys

enter

sc delete taskmon.sys

enter

skasuj folder:

C:\WINDOWS\system32\SvcNm

to daj zeby CI nie blokowalo

**Posty:** 10 · przez **Zathura** 28 Lis 2007, 20:16

nie widze takiego folderu ;/

[ Dodano: Dzisiaj o 19:17 ]
reszte zrobilem

**Posty:** 18165 · przez **wojtas** 28 Lis 2007, 20:25

Otworz notatnik i wklej w nim to:

Folder::
C:\WINDOWS\system32\SvcNm

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

Autor postu otrzymał pochwałę

**Posty:** 10 · przez **Zathura** 28 Lis 2007, 20:32

przelozylem plik tekstowy na combofixa i pojawilo sie pytanie "1 or 2" wziolem 1 i enter i zaczelo isc. potem zakonczylo sie i pokazalo loga, nie resetuja komputer, wczesniej tez nie resetowal sie

Log po skasowaniu:

Kod: Zaznacz wszystko: ComboFix 07-11-19.4 - Qba_2 2007-11-28 19:27:29.7 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.199 [GMT 1:00] Running from: C:\Documents and Settings\Qba_2\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Qba_2\Pulpit\CFScript.txt . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\SvcNm\ . ((((((((((((((((((((((((( Files Created from 2007-10-28 to 2007-11-28 ))))))))))))))))))))))))))))))) . 2007-11-28 16:33 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-11-28 16:33 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Kaspersky Lab 2007-11-28 07:36 <DIR> d-------- C:\Documents and Settings\Qba_2\Gadu-Gadu 2007-11-28 07:25 <DIR> d-------- C:\WINDOWS\ERUNT 2007-11-27 17:58 <DIR> d-------- C:\Documents and Settings\user_2\Dane aplikacji\Talkback 2007-11-27 15:34 <DIR> d-------- C:\Program Files\Spyware Doctor 2007-11-27 15:34 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\PC Tools 2007-11-27 15:34 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-11-27 15:34 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-11-27 15:34 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-11-27 15:34 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-11-27 15:33 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-11-27 15:24 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Lavasoft 2007-11-27 15:04 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Gadu-Gadu 2007-11-27 14:07 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Talkback 2007-11-27 13:52 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Tibia 2007-11-27 13:51 <DIR> d-------- C:\Documents and Settings\Qba_2\Wapster 2007-11-27 13:36 <DIR> d-------- C:\Documents and Settings\user_2\Dane aplikacji\Gadu-Gadu 2007-11-27 13:35 <DIR> d-------- C:\Documents and Settings\user_2\Gadu-Gadu 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\user_2\Ustawienia lokalne 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\user_2\Ulubione 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\user_2\Szablony 2007-11-27 13:31 <DIR> d-------- C:\Documents and Settings\user_2\Pulpit 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\user_2\Moje dokumenty 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\user_2\Menu Start 2007-11-27 13:31 <DIR> dr-h----- C:\Documents and Settings\user_2\Dane aplikacji 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\Qba_2\Ustawienia lokalne 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\Qba_2\Ulubione 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\Qba_2\Szablony 2007-11-27 13:31 <DIR> d-------- C:\Documents and Settings\Qba_2\Pulpit 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\Qba_2\Moje dokumenty 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\Qba_2\Menu Start 2007-11-27 13:31 <DIR> dr-h----- C:\Documents and Settings\Qba_2\Dane aplikacji 2007-11-27 13:28 <DIR> d--h----- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Ustawienia lokalne 2007-11-27 13:28 <DIR> d-------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Ulubione 2007-11-27 13:28 <DIR> d--h----- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Szablony 2007-11-27 13:28 <DIR> d-------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Pulpit 2007-11-27 13:28 <DIR> d-------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Moje dokumenty 2007-11-27 13:28 <DIR> dr------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Menu Start 2007-11-27 13:28 <DIR> dr-h----- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Dane aplikacji 2007-11-27 09:42 <DIR> d-------- C:\Program Files\Lavasoft 2007-11-27 09:16 <DIR> d--hs---- C:\WINDOWS\dXNlcg 2007-11-27 09:16 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Menu Start 2007-11-27 09:16 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Menu Start 2007-11-27 09:15 4 --a------ C:\WINDOWS\system32\SvcNm 2007-11-22 15:43 <DIR> d-------- C:\Program Files\TibiaCam TV Lite 2007-11-22 15:31 <DIR> d-------- C:\Program Files\Trend Micro 2007-11-18 08:56 <DIR> d-------- C:\Program Files\Alwil Software 2007-11-18 08:56 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2007-11-18 08:56 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-11-18 08:56 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-11-10 11:24 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Adobe Systems 2007-11-10 11:22 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-11-09 19:18 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2007-11-04 11:34 376 --a------ C:\WINDOWS\mozregistry.dat 2007-11-04 11:33 <DIR> d-------- C:\Program Files\hp deskjet 845c series 2007-11-04 11:33 <DIR> d-------- C:\Program Files\Hewlett-Packard 2007-11-03 23:25 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2007-11-03 21:13 <DIR> d-------- C:\Program Files\RALINK 2007-11-03 21:13 86,016 --a------ C:\WINDOWS\system32\install.dll 2007-11-03 21:13 45,056 --a------ C:\WINDOWS\system32\DEDriverDLL.dll 2007-11-03 21:13 36,864 --a------ C:\WINDOWS\system32\WRLSetup.exe 2007-11-03 21:13 32,768 --a------ C:\WINDOWS\system32\SmartInstallCfg2.dll 2007-11-03 21:08 <DIR> d-------- C:\Program Files\PerfMon3x 2007-11-03 20:56 <DIR> d-------- C:\WINDOWS\SHELLNEW 2007-11-03 20:56 <DIR> d-------- C:\Program Files\Microsoft Works 2007-11-03 20:55 <DIR> d-------- C:\Program Files\Microsoft.NET 2007-11-03 20:52 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-11-03 20:52 115,880 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-11-03 20:49 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\CyberLink 2007-11-03 20:47 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2007-11-03 20:47 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2007-11-03 20:46 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Apple Computer 2007-11-03 20:46 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-11-03 20:46 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-11-03 20:46 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-11-03 20:46 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-11-03 20:46 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-11-03 20:46 10,752 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-11-03 20:46 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest 2007-11-03 20:45 1,415,680 --a------ C:\WINDOWS\system32\WMV9VCM.dll 2007-11-03 20:45 921,600 --a------ C:\WINDOWS\system32\vorbisenc.dll 2007-11-03 20:45 301,568 --a------ C:\WINDOWS\system32\l3codecp.acm 2007-11-03 20:45 237,568 --a------ C:\WINDOWS\system32\OggDS.dll 2007-11-03 20:45 188,416 --a------ C:\WINDOWS\system32\vorbis.dll 2007-11-03 20:45 106,496 --a------ C:\WINDOWS\system32\lmpgspl.ax 2007-11-03 20:45 45,056 --a------ C:\WINDOWS\system32\ogg.dll 2007-11-03 20:44 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-11-03 20:44 77,824 --a------ C:\WINDOWS\system32\xvid.ax 2007-11-03 20:39 171,776 --a--c--- C:\WINDOWS\system32\dllcache\kmixer.sys 2007-11-03 20:39 145,792 --a--c--- C:\WINDOWS\system32\dllcache\portcls.sys 2007-11-03 20:39 130,048 --a------ C:\WINDOWS\system32\ksproxy.ax 2007-11-03 20:39 82,944 --a--c--- C:\WINDOWS\system32\dllcache\wdmaud.sys 2007-11-03 20:39 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys 2007-11-03 20:39 60,288 --a--c--- C:\WINDOWS\system32\dllcache\drmk.sys 2007-11-03 20:39 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys 2007-11-03 20:39 52,864 --a--c--- C:\WINDOWS\system32\dllcache\dmusic.sys 2007-11-03 20:39 6,400 --a--c--- C:\WINDOWS\system32\dllcache\splitter.sys 2007-11-03 20:39 5,376 --a--c--- C:\WINDOWS\system32\dllcache\mspclock.sys 2007-11-03 20:39 4,992 --a--c--- C:\WINDOWS\system32\dllcache\mspqm.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-18 10:41 --------- d-----w C:\Program Files\Tibia 2007-11-10 10:22 --------- d-----w C:\Program Files\Common Files\Adobe 2007-11-05 06:52 --------- d-----w C:\Program Files\Gadu-Gadu 2007-11-03 20:53 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2007-11-03 20:13 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-03 19:46 --------- d-----w C:\Program Files\K-Lite Codec Pack 2007-11-03 19:45 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll 2007-11-03 19:45 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll 2007-11-03 19:44 --------- d-----w C:\Program Files\Java 2007-11-03 19:43 --------- d-----w C:\Program Files\S3 2007-11-03 19:32 --------- d-----w C:\Program Files\AvRack . ((((((((((((((((((((((((((((( snapshot@2007-11-27_20.45.39.45 ))))))))))))))))))))))))))))))))))))))))) . + 2007-11-23 12:11:56 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2007-11-28 13:15:47 548,864 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2007-11-28 13:15:47 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2007-11-23 12:11:56 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2007-11-28 06:25:05 524,288 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2007-11-28 06:25:05 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat + 2005-05-24 11:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll + 2007-08-29 14:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe + 2007-08-29 14:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll - 2007-11-27 14:35:36 59,576 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-11-27 19:49:07 59,576 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-11-27 14:35:36 75,706 ----a-w C:\WINDOWS\system32\perfc015.dat + 2007-11-27 19:49:07 75,706 ----a-w C:\WINDOWS\system32\perfc015.dat - 2007-11-27 14:35:36 395,336 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-11-27 19:49:07 395,336 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-11-27 14:35:36 451,564 ----a-w C:\WINDOWS\system32\perfh015.dat + 2007-11-27 19:49:07 451,564 ----a-w C:\WINDOWS\system32\perfh015.dat + 2007-11-28 17:49:08 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_550.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HDAudDeck"="C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe" [2006-09-29 13:56] "VTTimer"="VTTimer.exe" [2005-03-08 03:33 C:\WINDOWS\system32\VTTimer.exe] "VTTrayp"="VTtrayp.exe" [2005-11-01 04:15 C:\WINDOWS\system32\VTTrayp.exe] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24] "DrvIcon"="C:\Program Files\Vista Drive Icon\DrvIcon.exe" [2007-07-04 20:59] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe" [2001-07-20 11:20] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44] C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26] RaConfig.lnk - C:\WINDOWS\system32\RaConfig.exe [2007-11-03 21:13:27] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "System"="csgfw.exe" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" R0 viamraid;viamraid;C:\WINDOWS\system32\drivers\viamraid.sys R3 RT2400;RT2400 Wireless Driver;C:\WINDOWS\system32\DRIVERS\RT2400.sys . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-28 19:28:36 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-28 19:29:09 C:\ComboFix2.txt ... 2007-11-28 19:07 C:\ComboFix3.txt ... 2007-11-28 18:59 . --- E O F ---

Log z Hijacka:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:31:02, on 2007-11-28 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\VTTimer.exe C:\WINDOWS\system32\VTtrayp.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Vista Drive Icon\DrvIcon.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\RaConfig.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\Documents and Settings\Qba_2\Pulpit\TBI GG 8.0.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1 O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [DrvIcon] C:\Program Files\Vista Drive Icon\DrvIcon.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: RaConfig.lnk = C:\WINDOWS\system32\RaConfig.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe -- End of file - 4400 bytes

**Posty:** 18165 · przez **wojtas** 28 Lis 2007, 21:49

Otworz notatnik i wklej w nim to:

Folder::
C:\WINDOWS\dXNlcg
C:\WINDOWS\system32\SvcNm

Plik >>> zapisz jako CFScript.txt . i przeciagnij na ikonke combo

wklej do notatnika

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\software\microsoft\windowsnt\currentversion\winlogon]
"System"=-

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

**Posty:** 10 · przez **Zathura** 29 Lis 2007, 16:05

Zrobilem co kasałeś.
Log z combofixa po przeciagnieciu:

Kod: Zaznacz wszystko: ComboFix 07-11-19.4 - Qba_2 2007-11-29 15:00:27.8 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.203 [GMT 1:00] Running from: C:\Documents and Settings\Qba_2\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Qba_2\Pulpit\CFScript.txt * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\dXNlcg C:\WINDOWS\system32\SvcNm\ . ((((((((((((((((((((((((( Files Created from 2007-10-28 to 2007-11-29 ))))))))))))))))))))))))))))))) . 2007-11-28 20:17 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-11-28 16:33 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-11-28 16:33 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Kaspersky Lab 2007-11-28 07:36 <DIR> d-------- C:\Documents and Settings\Qba_2\Gadu-Gadu 2007-11-28 07:25 <DIR> d-------- C:\WINDOWS\ERUNT 2007-11-27 17:58 <DIR> d-------- C:\Documents and Settings\user_2\Dane aplikacji\Talkback 2007-11-27 15:34 <DIR> d-------- C:\Program Files\Spyware Doctor 2007-11-27 15:34 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\PC Tools 2007-11-27 15:34 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-11-27 15:34 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-11-27 15:34 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-11-27 15:34 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-11-27 15:33 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-11-27 15:24 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Lavasoft 2007-11-27 15:04 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Gadu-Gadu 2007-11-27 14:07 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Talkback 2007-11-27 13:52 <DIR> d-------- C:\Documents and Settings\Qba_2\Dane aplikacji\Tibia 2007-11-27 13:51 <DIR> d-------- C:\Documents and Settings\Qba_2\Wapster 2007-11-27 13:36 <DIR> d-------- C:\Documents and Settings\user_2\Dane aplikacji\Gadu-Gadu 2007-11-27 13:35 <DIR> d-------- C:\Documents and Settings\user_2\Gadu-Gadu 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\user_2\Ustawienia lokalne 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\user_2\Ulubione 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\user_2\Szablony 2007-11-27 13:31 <DIR> d-------- C:\Documents and Settings\user_2\Pulpit 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\user_2\Moje dokumenty 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\user_2\Menu Start 2007-11-27 13:31 <DIR> dr-h----- C:\Documents and Settings\user_2\Dane aplikacji 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\Qba_2\Ustawienia lokalne 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\Qba_2\Ulubione 2007-11-27 13:31 <DIR> d--h----- C:\Documents and Settings\Qba_2\Szablony 2007-11-27 13:31 <DIR> d-------- C:\Documents and Settings\Qba_2\Pulpit 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\Qba_2\Moje dokumenty 2007-11-27 13:31 <DIR> dr------- C:\Documents and Settings\Qba_2\Menu Start 2007-11-27 13:31 <DIR> dr-h----- C:\Documents and Settings\Qba_2\Dane aplikacji 2007-11-27 13:28 <DIR> d--h----- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Ustawienia lokalne 2007-11-27 13:28 <DIR> d-------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Ulubione 2007-11-27 13:28 <DIR> d--h----- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Szablony 2007-11-27 13:28 <DIR> d-------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Pulpit 2007-11-27 13:28 <DIR> d-------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Moje dokumenty 2007-11-27 13:28 <DIR> dr------- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Menu Start 2007-11-27 13:28 <DIR> dr-h----- C:\Documents and Settings\Administrator.USER-EEB918B9A6\Dane aplikacji 2007-11-27 09:42 <DIR> d-------- C:\Program Files\Lavasoft 2007-11-27 09:16 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Menu Start 2007-11-27 09:16 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Menu Start 2007-11-27 09:15 4 --a------ C:\WINDOWS\system32\SvcNm 2007-11-22 15:43 <DIR> d-------- C:\Program Files\TibiaCam TV Lite 2007-11-22 15:31 <DIR> d-------- C:\Program Files\Trend Micro 2007-11-18 08:56 <DIR> d-------- C:\Program Files\Alwil Software 2007-11-18 08:56 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2007-11-18 08:56 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-11-18 08:56 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-11-10 11:24 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Adobe Systems 2007-11-10 11:22 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-11-09 19:18 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2007-11-04 11:34 376 --a------ C:\WINDOWS\mozregistry.dat 2007-11-04 11:33 <DIR> d-------- C:\Program Files\hp deskjet 845c series 2007-11-04 11:33 <DIR> d-------- C:\Program Files\Hewlett-Packard 2007-11-03 23:25 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2007-11-03 21:13 <DIR> d-------- C:\Program Files\RALINK 2007-11-03 21:13 86,016 --a------ C:\WINDOWS\system32\install.dll 2007-11-03 21:13 45,056 --a------ C:\WINDOWS\system32\DEDriverDLL.dll 2007-11-03 21:13 36,864 --a------ C:\WINDOWS\system32\WRLSetup.exe 2007-11-03 21:13 32,768 --a------ C:\WINDOWS\system32\SmartInstallCfg2.dll 2007-11-03 21:08 <DIR> d-------- C:\Program Files\PerfMon3x 2007-11-03 20:56 <DIR> d-------- C:\WINDOWS\SHELLNEW 2007-11-03 20:56 <DIR> d-------- C:\Program Files\Microsoft Works 2007-11-03 20:55 <DIR> d-------- C:\Program Files\Microsoft.NET 2007-11-03 20:52 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-11-03 20:52 115,880 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-11-03 20:49 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\CyberLink 2007-11-03 20:47 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2007-11-03 20:47 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2007-11-03 20:46 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Apple Computer 2007-11-03 20:46 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-11-03 20:46 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-11-03 20:46 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-11-03 20:46 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-11-03 20:46 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-11-03 20:46 10,752 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-11-03 20:46 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest 2007-11-03 20:45 1,415,680 --a------ C:\WINDOWS\system32\WMV9VCM.dll 2007-11-03 20:45 921,600 --a------ C:\WINDOWS\system32\vorbisenc.dll 2007-11-03 20:45 301,568 --a------ C:\WINDOWS\system32\l3codecp.acm 2007-11-03 20:45 237,568 --a------ C:\WINDOWS\system32\OggDS.dll 2007-11-03 20:45 188,416 --a------ C:\WINDOWS\system32\vorbis.dll 2007-11-03 20:45 106,496 --a------ C:\WINDOWS\system32\lmpgspl.ax 2007-11-03 20:45 45,056 --a------ C:\WINDOWS\system32\ogg.dll 2007-11-03 20:44 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-11-03 20:44 77,824 --a------ C:\WINDOWS\system32\xvid.ax 2007-11-03 20:39 171,776 --a--c--- C:\WINDOWS\system32\dllcache\kmixer.sys 2007-11-03 20:39 145,792 --a--c--- C:\WINDOWS\system32\dllcache\portcls.sys 2007-11-03 20:39 130,048 --a------ C:\WINDOWS\system32\ksproxy.ax 2007-11-03 20:39 82,944 --a--c--- C:\WINDOWS\system32\dllcache\wdmaud.sys 2007-11-03 20:39 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys 2007-11-03 20:39 60,288 --a--c--- C:\WINDOWS\system32\dllcache\drmk.sys 2007-11-03 20:39 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys 2007-11-03 20:39 52,864 --a--c--- C:\WINDOWS\system32\dllcache\dmusic.sys 2007-11-03 20:39 6,400 --a--c--- C:\WINDOWS\system32\dllcache\splitter.sys 2007-11-03 20:39 5,376 --a--c--- C:\WINDOWS\system32\dllcache\mspclock.sys 2007-11-03 20:39 4,992 --a--c--- C:\WINDOWS\system32\dllcache\mspqm.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-18 10:41 --------- d-----w C:\Program Files\Tibia 2007-11-10 10:22 --------- d-----w C:\Program Files\Common Files\Adobe 2007-11-05 06:52 --------- d-----w C:\Program Files\Gadu-Gadu 2007-11-03 20:53 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2007-11-03 20:13 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-03 19:46 --------- d-----w C:\Program Files\K-Lite Codec Pack 2007-11-03 19:45 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll 2007-11-03 19:45 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll 2007-11-03 19:44 --------- d-----w C:\Program Files\Java 2007-11-03 19:43 --------- d-----w C:\Program Files\S3 2007-11-03 19:32 --------- d-----w C:\Program Files\AvRack . ((((((((((((((((((((((((((((( snapshot@2007-11-27_20.45.39.45 ))))))))))))))))))))))))))))))))))))))))) . + 2007-11-23 12:11:56 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2007-11-28 13:15:47 548,864 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2007-11-28 13:15:47 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2007-11-23 12:11:56 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2007-11-28 06:25:05 524,288 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2007-11-28 06:25:05 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat + 2005-05-24 11:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll + 2007-08-29 14:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe + 2007-08-29 14:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll - 2007-11-27 14:35:36 59,576 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-11-27 19:49:07 59,576 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-11-27 14:35:36 75,706 ----a-w C:\WINDOWS\system32\perfc015.dat + 2007-11-27 19:49:07 75,706 ----a-w C:\WINDOWS\system32\perfc015.dat - 2007-11-27 14:35:36 395,336 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-11-27 19:49:07 395,336 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-11-27 14:35:36 451,564 ----a-w C:\WINDOWS\system32\perfh015.dat + 2007-11-27 19:49:07 451,564 ----a-w C:\WINDOWS\system32\perfh015.dat + 2007-11-29 13:56:26 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_554.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HDAudDeck"="C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe" [2006-09-29 13:56] "VTTimer"="VTTimer.exe" [2005-03-08 03:33 C:\WINDOWS\system32\VTTimer.exe] "VTTrayp"="VTtrayp.exe" [2005-11-01 04:15 C:\WINDOWS\system32\VTTrayp.exe] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24] "DrvIcon"="C:\Program Files\Vista Drive Icon\DrvIcon.exe" [2007-07-04 20:59] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe" [2001-07-20 11:20] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44] C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26] RaConfig.lnk - C:\WINDOWS\system32\RaConfig.exe [2007-11-03 21:13:27] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "System"="csgfw.exe" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" R0 viamraid;viamraid;C:\WINDOWS\system32\drivers\viamraid.sys R3 RT2400;RT2400 Wireless Driver;C:\WINDOWS\system32\DRIVERS\RT2400.sys . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-29 15:01:52 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-29 15:02:25 C:\ComboFix2.txt ... 2007-11-28 19:29 C:\ComboFix3.txt ... 2007-11-28 19:07 . --- E O F ---

i dodalem do rejestru.

**Posty:** 3854 · przez **Dzi@dek** 29 Lis 2007, 16:41

Powinno być OK.

połączenia i viry

Połączenia i viry

-

-

-

-

-

-

-

Kto jest na forum