proszę o sprawdzenie loga (popupy, blokada menadzera zadan)

**Posty:** 27 · przez **b0br** 24 Mar 2008, 15:25

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:06:13, on 2008-03-24 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe D:\Programy\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\STacSV.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\nopohqze.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\system32\sqkgetkm.exe D:\Programy\Tlen\tlen.exe D:\Programy\Pulpity\Yodm3D.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\OpenOffice.ux.pl 2.3.1\program\soffice.exe C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe C:\Program Files\OpenOffice.ux.pl 2.3.1\program\soffice.BIN D:\Programy\Xfire\Xfire.exe C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Neostrada TP\NeostradaTP.exe C:\Program Files\Neostrada TP\ComComp.exe C:\Program Files\Neostrada TP\Watch.exe C:\WINDOWS\system32\wuauclt.exe D:\Programy\Przeglądarki\Mozilla\firefox.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - D:\Programy\Sidebar\sbhelp.dll O2 - BHO: GNX Bingo - {58E97D4A-DE0F-4279-ACA5-5657144B05C9} - C:\WINDOWS\kdftlboevfp.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe O4 - HKLM\..\Run: [sqkgetkm] C:\WINDOWS\system32\sqkgetkm.exe O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray O4 - HKCU\..\Run: [Komunikator] D:\Programy\Tlen\tlen.exe O4 - HKCU\..\Run: [Yodm3D] D:\Programy\Pulpity\Yodm3D.exe O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Programy\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKLM\..\Policies\Explorer\Run: [CyR5x8Vw47] C:\WINDOWS\nopohqze.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: OpenOffice.ux.pl 2.3.1.lnk = C:\Program Files\OpenOffice.ux.pl 2.3.1\program\quickstart.exe O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe O4 - Startup: Xfire.lnk = D:\Programy\Xfire\Xfire.exe O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - D:\Programy\Sidebar\sbhelp.dll O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - D:\Programy\Sidebar\sbhelp.dll O10 - Unknown file in Winsock LSP: xfire_lsp_10650.dll O10 - Unknown file in Winsock LSP: xfire_lsp_10650.dll O10 - Unknown file in Winsock LSP: xfire_lsp_10650.dll O10 - Unknown file in Winsock LSP: xfire_lsp_10650.dll O10 - Unknown file in Winsock LSP: xfire_lsp_10650.dll O10 - Unknown file in Winsock LSP: xfire_lsp_10650.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://arcaonline.arcabit.com/ArcaOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{735854D5-65FF-4E98-8B11-CC3803B51CFE}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - D:\Programy\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\STacSV.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- End of file - 7630 bytes

Proszę o sprawdzenie tego loga. Wyswietlają mi sie popupy reklamujace jakis antywirus, wykrywajace spyware. Zablokowany jest rowniez menadzer zadan.

**Posty:** 8001 · przez **Okocza** 24 Mar 2008, 15:35

Log SDFix, combofix, sillentrunners i do tego http://www.forum.programosy.pl/bad-generic-host-process-for-win32-services-vt79489.html

oraz

http://www.forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

sdfix

Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt

**Posty:** 27 · przez **b0br** 24 Mar 2008, 15:56

Report.txt:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.160 [/b] Run by Intel on 2008-03-24 at 14:44 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\WINDOWS\kdftlboevfp.dll - Deleted C:\WINDOWS\dwnrpofk.dll - Deleted C:\WINDOWS\rs.txt - Deleted Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-24 14:49:48 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] "Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,.. scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "D:\\Programy\\Tlen\\tlen.exe"="D:\\Programy\\Tlen\\tlen.exe:*:Enabled:Komunikator Tlen.pl" "D:\\Programy\\eMule\\emule.exe"="D:\\Programy\\eMule\\emule.exe:*:Enabled:eMule" "D:\\Programy\\Xfire\\ua_lsp_inst.exe"="D:\\Programy\\Xfire\\ua_lsp_inst.exe:*:Enabled:ua_lsp_inst" "D:\\Programy\\Xfire\\Xfire.exe"="D:\\Programy\\Xfire\\Xfire.exe:*:Enabled:Xfire" "D:\\Gry\\Call of Duty\\CoDUOMP.exe"="D:\\Gry\\Call of Duty\\CoDUOMP.exe:*:Enabled:CoDUOMP" "D:\\Programy\\The All-Seeing Eye\\eye.exe"="D:\\Programy\\The All-Seeing Eye\\eye.exe:*:Enabled:Yahoo! All-Seeing Eye" "E:\\Programy\\totalcmd\\TOTALCMD.EXE"="E:\\Programy\\totalcmd\\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows" "D:\\Gry\\Call of Duty\\CoDMP.exe"="D:\\Gry\\Call of Duty\\CoDMP.exe:*:Enabled:CoDMP" "C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA" "C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB" "E:\\Programy\\The All-Seeing Eye\\eye.exe"="E:\\Programy\\The All-Seeing Eye\\eye.exe:*:Enabled:Yahoo! All-Seeing Eye" "C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test" "C:\\WINDOWS\\system32\\rundll32.exe"="C:\\WINDOWS\\system32\\rundll32.exe:*:Enabled:Uruchamia plik DLL jako aplikacj©" "E:\\Programy\\eMule\\emule.exe"="E:\\Programy\\eMule\\emule.exe:*:Enabled:eMule" "D:\\Programy\\SwiftSwitch\\SwiftSwitch.exe"="D:\\Programy\\SwiftSwitch\\SwiftSwitch.exe:*:Enabled:Utility for RuneScape" "D:\\Programy\\Opera\\Opera.exe"="D:\\Programy\\Opera\\Opera.exe:*:Enabled:Opera Internet Browser" "D:\\Programy\\hamaczi\\hamachi.exe"="D:\\Programy\\hamaczi\\hamachi.exe:*:Enabled:Hamachi Client" "D:\\Programy\\mIRC\\mirc.exe"="D:\\Programy\\mIRC\\mirc.exe:*:Enabled:mIRC" "D:\\Programy\\jonny\\mirc.exe"="D:\\Programy\\jonny\\mirc.exe:*:Enabled:mIRC" "C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"="C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) " "D:\\Programy\\PrzeglĄdarki\\Mozilla\\firefox.exe"="D:\\Programy\\PrzeglĄdarki\\Mozilla\\firefox.exe:*:Enabled:Firefox" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Wed 19 Mar 2008 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Thu 2 Mar 2006 468,480 A.SH. --- "C:\WINDOWS\BricoPacks\SysFiles\79_iexplore.exe" Thu 24 Jan 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BIT231.tmp" [b]Finished![/b]

**Posty:** 8001 · przez **Okocza** 24 Mar 2008, 15:58

okocza napisał(a):combofix, sillentrunners

jeszcze

**Posty:** 27 · przez **b0br** 24 Mar 2008, 16:07

Silent Runners:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.160 [/b] Run by Intel on 2008-03-24 at 14:44 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\WINDOWS\kdftlboevfp.dll - Deleted C:\WINDOWS\dwnrpofk.dll - Deleted C:\WINDOWS\rs.txt - Deleted Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-24 14:49:48 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] "Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,.. scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "D:\\Programy\\Tlen\\tlen.exe"="D:\\Programy\\Tlen\\tlen.exe:*:Enabled:Komunikator Tlen.pl" "D:\\Programy\\eMule\\emule.exe"="D:\\Programy\\eMule\\emule.exe:*:Enabled:eMule" "D:\\Programy\\Xfire\\ua_lsp_inst.exe"="D:\\Programy\\Xfire\\ua_lsp_inst.exe:*:Enabled:ua_lsp_inst" "D:\\Programy\\Xfire\\Xfire.exe"="D:\\Programy\\Xfire\\Xfire.exe:*:Enabled:Xfire" "D:\\Gry\\Call of Duty\\CoDUOMP.exe"="D:\\Gry\\Call of Duty\\CoDUOMP.exe:*:Enabled:CoDUOMP" "D:\\Programy\\The All-Seeing Eye\\eye.exe"="D:\\Programy\\The All-Seeing Eye\\eye.exe:*:Enabled:Yahoo! All-Seeing Eye" "E:\\Programy\\totalcmd\\TOTALCMD.EXE"="E:\\Programy\\totalcmd\\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows" "D:\\Gry\\Call of Duty\\CoDMP.exe"="D:\\Gry\\Call of Duty\\CoDMP.exe:*:Enabled:CoDMP" "C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA" "C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB" "E:\\Programy\\The All-Seeing Eye\\eye.exe"="E:\\Programy\\The All-Seeing Eye\\eye.exe:*:Enabled:Yahoo! All-Seeing Eye" "C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test" "C:\\WINDOWS\\system32\\rundll32.exe"="C:\\WINDOWS\\system32\\rundll32.exe:*:Enabled:Uruchamia plik DLL jako aplikacj©" "E:\\Programy\\eMule\\emule.exe"="E:\\Programy\\eMule\\emule.exe:*:Enabled:eMule" "D:\\Programy\\SwiftSwitch\\SwiftSwitch.exe"="D:\\Programy\\SwiftSwitch\\SwiftSwitch.exe:*:Enabled:Utility for RuneScape" "D:\\Programy\\Opera\\Opera.exe"="D:\\Programy\\Opera\\Opera.exe:*:Enabled:Opera Internet Browser" "D:\\Programy\\hamaczi\\hamachi.exe"="D:\\Programy\\hamaczi\\hamachi.exe:*:Enabled:Hamachi Client" "D:\\Programy\\mIRC\\mirc.exe"="D:\\Programy\\mIRC\\mirc.exe:*:Enabled:mIRC" "D:\\Programy\\jonny\\mirc.exe"="D:\\Programy\\jonny\\mirc.exe:*:Enabled:mIRC" "C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"="C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) " "D:\\Programy\\PrzeglĄdarki\\Mozilla\\firefox.exe"="D:\\Programy\\PrzeglĄdarki\\Mozilla\\firefox.exe:*:Enabled:Firefox" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Wed 19 Mar 2008 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Thu 2 Mar 2006 468,480 A.SH. --- "C:\WINDOWS\BricoPacks\SysFiles\79_iexplore.exe" Thu 24 Jan 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BIT231.tmp" [b]Finished![/b]

Jak sprawdzic loga programem combofix? Pojawilo mi sie okienko:

Kod: Zaznacz wszystko: Roughly 1/100 machines failed to make it through the disinfection process!! Are you sure you want to do this?

**Posty:** 8001 · przez **Okocza** 24 Mar 2008, 16:21

masz kliknąć yes

**Posty:** 27 · przez **b0br** 24 Mar 2008, 16:27

Kod: Zaznacz wszystko: ComboFix 08-03-23.2 - Intel 2008-03-24 15:25:30.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.403 [GMT 1:00] Running from: C:\Documents and Settings\Intel\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\Cfx32.lic C:\WINDOWS\system32\cfx32.ocx . ((((((((((((((((((((((((( Files Created from 2008-02-24 to 2008-03-24 ))))))))))))))))))))))))))))))) . 2008-03-24 14:42 . 2008-03-24 14:42 <DIR> d-------- C:\WINDOWS\ERUNT 2008-03-24 14:38 . 2008-03-24 14:53 <DIR> d-------- C:\SDFix 2008-03-24 14:04 . 2008-03-24 14:04 <DIR> d-------- C:\Program Files\Trend Micro 2008-03-24 12:06 . 2008-03-24 12:06 <DIR> d-------- C:\Program Files\Webroot 2008-03-24 12:06 . 2008-01-04 20:56 1,526,640 --a------ C:\WINDOWS\WRSetup.dll 2008-03-24 12:02 . 2008-03-24 12:02 164 --a------ C:\install.dat 2008-03-23 17:43 . 2008-03-23 17:43 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft 2008-03-23 17:42 . 2008-03-23 17:42 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-03-23 16:29 . 2008-03-23 16:29 <DIR> d-------- C:\Documents and Settings\Intel\Dane aplikacji\PC-Cleaner 2008-03-23 16:28 . 2008-03-23 17:02 <DIR> d-------- C:\Program Files\PC-Cleaner 2008-03-22 23:08 . 2008-03-22 23:08 94,208 --a------ C:\WINDOWS\system32\sqkgetkm.exe 2008-03-22 23:08 . 2008-03-22 23:08 36,352 --a------ C:\WINDOWS\nopohqze.exe 2008-03-14 00:06 . 2008-03-14 00:06 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll 2008-02-24 12:33 . 2008-02-24 12:33 5,760,054 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp 2008-02-24 12:33 . 2008-02-24 12:33 65,026 --a------ C:\WINDOWS\BricoPackUninst.cmd 2008-02-24 12:31 . 2008-02-24 12:31 <DIR> d-------- C:\WINDOWS\BricoPacks 2008-02-24 12:31 . 2008-02-24 12:33 6,114 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-24 13:54 --------- d-----w C:\Program Files\Neostrada TP 2008-03-24 13:53 --------- d-----w C:\Documents and Settings\Intel\Dane aplikacji\OpenOffice.ux.pl2 2008-03-23 19:40 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-03-23 19:39 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-03-23 19:37 --------- d-----w C:\Documents and Settings\Intel\Dane aplikacji\Tlen.pl 2008-03-22 18:09 --------- d-----w C:\Documents and Settings\Intel\Dane aplikacji\teamspeak2 2008-03-18 15:26 --------- d-----w C:\Documents and Settings\Intel\Dane aplikacji\Xfire 2008-03-15 19:04 --------- d-----w C:\Program Files\Winamp 2008-03-15 18:53 --------- d-----w C:\Documents and Settings\Intel\Dane aplikacji\gtk-2.0 2008-02-21 14:01 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2008-02-11 22:26 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Dane aplikacji\Xfire 2008-02-11 22:26 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Dane aplikacji\ATI 2008-02-10 14:29 --------- d-----w C:\Documents and Settings\Intel\Dane aplikacji\mIRC 2008-02-06 21:22 --------- d-----w C:\Program Files\Autopano-SIFT-2.3 2008-02-06 18:05 --------- d-----w C:\Program Files\OpenOffice.ux.pl 2.3.1 2008-02-02 11:02 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-18 10:11 50,520 ----a-w C:\WINDOWS\system32\csvidcap.dll 2008-01-14 12:52 81,920 ----a-w C:\WINDOWS\system32\frapsvid.dll 2007-11-17 12:39 22,328 ----a-w C:\Documents and Settings\Intel\Dane aplikacji\PnkBstrK.sys 2006-03-02 12:00 468,480 --sha-w C:\WINDOWS\BricoPacks\SysFiles\79_iexplore.exe . ------- Sigcheck ------- 2007-08-22 13:58 668160 07608337038c78cdaba8650089837a58 C:\WINDOWS\$hf_mig$\KB939653\SP2QFE\wininet.dll 2007-10-11 07:11 668672 334d5a77651092b0d0ee79dd9e194517 C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\wininet.dll 2007-12-07 01:48 668672 5c0b1281e1245d2f4af571b21b0ab21f C:\WINDOWS\$hf_mig$\KB944533\SP2QFE\wininet.dll 2006-03-02 13:00 658944 d37dafb534ac8343d59a1b501abe852c C:\WINDOWS\$NtUninstallKB939653$\wininet.dll 2007-08-22 14:19 661504 ec234cc41563be7778fff21512cb0d7a C:\WINDOWS\$NtUninstallKB942615$\wininet.dll 2007-10-11 07:14 662016 242d9348069784fd3de7674516993a81 C:\WINDOWS\$NtUninstallKB944533$\wininet.dll 2007-12-07 02:08 696320 77fb92332e15ff77a8d8ff983bb2809b C:\WINDOWS\system32\wininet.dll 2007-12-07 02:08 696320 77fb92332e15ff77a8d8ff983bb2809b C:\WINDOWS\system32\dllcache\wininet.dll 2007-06-13 14:23 976896 e74ef52c79f3347a0b105b0b92bfed38 C:\WINDOWS\explorer.exe 2007-06-13 14:12 1034752 8db0650b211425b9cdb7d1c4a8f6b482 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe 2006-03-02 13:00 1033728 379098a96e6c165b659de7e4328010ea C:\WINDOWS\$NtUninstallKB938828$\explorer.exe 2007-06-13 14:23 976896 e74ef52c79f3347a0b105b0b92bfed38 C:\WINDOWS\system32\dllcache\explorer.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Komunikator"="D:\Programy\Tlen\tlen.exe" [2007-11-07 15:33 6234624] "Yodm3D"="D:\Programy\Pulpity\Yodm3D.exe" [2007-06-26 19:26 2058752] "Gadu-Gadu"="E:\Programy\Gadu-Gadu\gg.exe" [2007-05-10 15:36 2111176] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50 155648] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 10:12 90112] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 19:24 32768] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] "WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 19:07 24576] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38 866816] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07 20480] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 19:07 53248] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "SigmatelSysTrayApp"="sttray.exe" [] "sqkgetkm"="C:\WINDOWS\system32\sqkgetkm.exe" [2008-03-22 23:08 94208] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 13:00 15360] C:\Documents and Settings\Intel\Menu Start\Programy\Autostart\ OpenOffice.ux.pl 2.3.1.lnk - C:\Program Files\OpenOffice.ux.pl 2.3.1\program\quickstart.exe [2007-12-07 17:58:08 17408] RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-18 23:05:02 630784] TransBar.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 20:41:18 65536] UberIcon.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 08:43:08 180224] Xfire.lnk - D:\Programy\Xfire\Xfire.exe [2008-03-14 00:06:18 2979664] Y'z Shadow.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 08:43:14 155648] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "UIHost"="LogonUI.EXE" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\Programy\\Tlen\\tlen.exe"= "D:\\Programy\\eMule\\emule.exe"= "D:\\Programy\\Xfire\\ua_lsp_inst.exe"= "D:\\Programy\\Xfire\\Xfire.exe"= "D:\\Gry\\Call of Duty\\CoDUOMP.exe"= "D:\\Programy\\The All-Seeing Eye\\eye.exe"= "E:\\Programy\\totalcmd\\TOTALCMD.EXE"= "D:\\Gry\\Call of Duty\\CoDMP.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= "E:\\Programy\\The All-Seeing Eye\\eye.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "C:\\WINDOWS\\system32\\rundll32.exe"= "E:\\Programy\\eMule\\emule.exe"= "D:\\Programy\\SwiftSwitch\\SwiftSwitch.exe"= "D:\\Programy\\Opera\\Opera.exe"= "D:\\Programy\\hamaczi\\hamachi.exe"= "D:\\Programy\\mIRC\\mirc.exe"= "D:\\Programy\\jonny\\mirc.exe"= "C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"= "D:\\Programy\\Przeglądarki\\Mozilla\\firefox.exe"= . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-24 15:26:17 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe -> C:\WINDOWS\system32\xfire_lsp_10650.dll . Completion time: 2008-03-24 15:26:34 ComboFix-quarantined-files.txt 2008-03-24 14:26:32 . 2008-03-15 22:33:22 --- E O F ---

Menedzer zadan juz jest odblokowany. Niestety popupy nadal sie wyswietlaja ehh.

**Posty:** 8001 · przez **Okocza** 24 Mar 2008, 16:48

przeskanuj system Ewido i jakimś antywirusem.

**Posty:** 27 · przez **b0br** 24 Mar 2008, 17:34

Przeskanowałem. Znalazlo mi 18 infekcji. Wszystkie skasowalem. Reklamy są nadal :<

**Posty:** 18165 · przez **wojtas** 24 Mar 2008, 20:13

zastosuj:

smitfraudfix z opcji 2
(sciagasz -> uruchamiasz-> klikasz dowolny klawisz -> wpisujesz w programie 2 i enter potem czekasz chwile -> gdy wyskoczy pytanie w programie Do you want to clean the registry ? to wpisujesz literke Y i znowu enter i czekasz do wyskoczenia raportu (znak ze skan dobiegł konca)

wklej do notatnika:

File::
C:\WINDOWS\system32\sqkgetkm.exe
C:\WINDOWS\nopohqze.exe

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

znasz to:

C:\Program Files\PC-Cleaner

?

**Posty:** 27 · przez **b0br** 24 Mar 2008, 21:09

Kod: Zaznacz wszystko: ComboFix 08-03-23.2 - Intel 2008-03-24 20:02:28.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.454 [GMT 1:00] Running from: C:\Documents and Settings\Intel\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Intel\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\nopohqze.exe C:\WINDOWS\system32\sqkgetkm.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\nopohqze.exe C:\WINDOWS\system32\sqkgetkm.exe . ((((((((((((((((((((((((( Files Created from 2008-02-24 to 2008-03-24 ))))))))))))))))))))))))))))))) . 2008-03-24 19:58 . 2008-03-24 19:58 1,594 --a------ C:\WINDOWS\system32\tmp.reg 2008-03-24 19:57 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-03-24 19:57 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-03-24 19:57 . 2008-03-22 15:49 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-03-24 19:57 . 2008-03-15 17:16 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-03-24 19:57 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-03-24 19:57 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-03-24 19:57 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-03-24 14:42 . 2008-03-24 14:42 <DIR> d-------- C:\WINDOWS\ERUNT 2008-03-24 14:38 . 2008-03-24 14:53 <DIR> d-------- C:\SDFix 2008-03-24 14:04 . 2008-03-24 14:04 <DIR> d-------- C:\Program Files\Trend Micro 2008-03-24 12:02 . 2008-03-24 12:02 164 --a------ C:\install.dat 2008-03-23 17:43 . 2008-03-23 17:43 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft 2008-03-23 17:42 . 2008-03-23 17:42 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-03-23 16:29 . 2008-03-23 16:29 <DIR> d-------- C:\Documents and Settings\Intel\Dane aplikacji\PC-Cleaner 2008-03-23 16:28 . 2008-03-23 17:02 <DIR> d-------- C:\Program Files\PC-Cleaner 2008-03-14 00:06 . 2008-03-14 00:06 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll 2008-02-24 12:33 . 2008-02-24 12:33 5,760,054 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp 2008-02-24 12:33 . 2008-02-24 12:33 65,026 --a------ C:\WINDOWS\BricoPackUninst.cmd 2008-02-24 12:31 . 2008-02-24 12:31 <DIR> d-------- C:\WINDOWS\BricoPacks 2008-02-24 12:31 . 2008-02-24 12:33 6,114 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-24 19:04 --------- d-----w C:\Documents and Settings\Intel\Dane aplikacji\OpenOffice.ux.pl2 2008-03-24 18:54 --------- d-----w C:\Program Files\Neostrada TP 2008-03-24 18:52 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-03-24 15:10 --------- d-----w C:\Documents and Settings\Intel\Dane aplikacji\Tlen.pl 2008-03-22 18:09 --------- d-----w C:\Documents and Settings\Intel\Dane aplikacji\teamspeak2 2008-03-18 15:26 --------- d-----w C:\Documents and Settings\Intel\Dane aplikacji\Xfire 2008-03-15 19:04 --------- d-----w C:\Program Files\Winamp 2008-03-15 18:53 --------- d-----w C:\Documents and Settings\Intel\Dane aplikacji\gtk-2.0 2008-02-11 22:26 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Dane aplikacji\Xfire 2008-02-11 22:26 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Dane aplikacji\ATI 2008-02-10 14:29 --------- d-----w C:\Documents and Settings\Intel\Dane aplikacji\mIRC 2008-02-06 21:22 --------- d-----w C:\Program Files\Autopano-SIFT-2.3 2008-02-06 18:05 --------- d-----w C:\Program Files\OpenOffice.ux.pl 2.3.1 2008-02-02 11:02 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-17 12:39 22,328 ----a-w C:\Documents and Settings\Intel\Dane aplikacji\PnkBstrK.sys 2006-03-02 12:00 468,480 --sha-w C:\WINDOWS\BricoPacks\SysFiles\79_iexplore.exe . ------- Sigcheck ------- 2007-08-22 13:58 668160 07608337038c78cdaba8650089837a58 C:\WINDOWS\$hf_mig$\KB939653\SP2QFE\wininet.dll 2007-10-11 07:11 668672 334d5a77651092b0d0ee79dd9e194517 C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\wininet.dll 2007-12-07 01:48 668672 5c0b1281e1245d2f4af571b21b0ab21f C:\WINDOWS\$hf_mig$\KB944533\SP2QFE\wininet.dll 2006-03-02 13:00 658944 d37dafb534ac8343d59a1b501abe852c C:\WINDOWS\$NtUninstallKB939653$\wininet.dll 2007-08-22 14:19 661504 ec234cc41563be7778fff21512cb0d7a C:\WINDOWS\$NtUninstallKB942615$\wininet.dll 2007-10-11 07:14 662016 242d9348069784fd3de7674516993a81 C:\WINDOWS\$NtUninstallKB944533$\wininet.dll 2007-12-07 02:08 696320 77fb92332e15ff77a8d8ff983bb2809b C:\WINDOWS\system32\wininet.dll 2007-12-07 02:08 696320 77fb92332e15ff77a8d8ff983bb2809b C:\WINDOWS\system32\dllcache\wininet.dll 2007-06-13 14:23 976896 e74ef52c79f3347a0b105b0b92bfed38 C:\WINDOWS\explorer.exe 2007-06-13 14:12 1034752 8db0650b211425b9cdb7d1c4a8f6b482 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe 2006-03-02 13:00 1033728 379098a96e6c165b659de7e4328010ea C:\WINDOWS\$NtUninstallKB938828$\explorer.exe 2007-06-13 14:23 976896 e74ef52c79f3347a0b105b0b92bfed38 C:\WINDOWS\system32\dllcache\explorer.exe . ((((((((((((((((((((((((((((( snapshot@2008-03-24_15.26.27,51 ))))))))))))))))))))))))))))))))))))))))) . - 2008-03-23 19:39:55 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe + 2008-03-24 18:51:58 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe + 2008-03-24 19:04:37 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_778.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Komunikator"="D:\Programy\Tlen\tlen.exe" [2007-11-07 15:33 6234624] "Yodm3D"="D:\Programy\Pulpity\Yodm3D.exe" [2007-06-26 19:26 2058752] "Gadu-Gadu"="E:\Programy\Gadu-Gadu\gg.exe" [2007-05-10 15:36 2111176] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50 155648] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 10:12 90112] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 19:24 32768] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] "WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 19:07 24576] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38 866816] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07 20480] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 19:07 53248] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "SigmatelSysTrayApp"="sttray.exe" [] "sqkgetkm"="C:\WINDOWS\system32\sqkgetkm.exe" [ ] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 13:00 15360] C:\Documents and Settings\Intel\Menu Start\Programy\Autostart\ OpenOffice.ux.pl 2.3.1.lnk - C:\Program Files\OpenOffice.ux.pl 2.3.1\program\quickstart.exe [2007-12-07 17:58:08 17408] RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-18 23:05:02 630784] TransBar.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 20:41:18 65536] UberIcon.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 08:43:08 180224] Xfire.lnk - D:\Programy\Xfire\Xfire.exe [2008-03-14 00:06:18 2979664] Y'z Shadow.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 08:43:14 155648] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "UIHost"="LogonUI.EXE" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\Programy\\Tlen\\tlen.exe"= "D:\\Programy\\eMule\\emule.exe"= "D:\\Programy\\Xfire\\ua_lsp_inst.exe"= "D:\\Programy\\Xfire\\Xfire.exe"= "D:\\Gry\\Call of Duty\\CoDUOMP.exe"= "D:\\Programy\\The All-Seeing Eye\\eye.exe"= "E:\\Programy\\totalcmd\\TOTALCMD.EXE"= "D:\\Gry\\Call of Duty\\CoDMP.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= "E:\\Programy\\The All-Seeing Eye\\eye.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "C:\\WINDOWS\\system32\\rundll32.exe"= "E:\\Programy\\eMule\\emule.exe"= "D:\\Programy\\SwiftSwitch\\SwiftSwitch.exe"= "D:\\Programy\\Opera\\Opera.exe"= "D:\\Programy\\hamaczi\\hamachi.exe"= "D:\\Programy\\mIRC\\mirc.exe"= "D:\\Programy\\jonny\\mirc.exe"= "C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"= . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-24 20:05:10 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe -> C:\WINDOWS\system32\xfire_lsp_10650.dll PROCESS: C:\WINDOWS\explorer.exe -> C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll -> C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon.dll -> D:\Programy\Tlen\hook.dll . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\Ati2evxx.exe D:\Programy\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE C:\WINDOWS\system32\PnkBstrB.exe C:\Program Files\OpenOffice.ux.pl 2.3.1\program\soffice.exe C:\Program Files\OpenOffice.ux.pl 2.3.1\program\soffice.BIN C:\WINDOWS\system32\STacSV.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe . ************************************************************************** . Completion time: 2008-03-24 20:06:56 - machine was rebooted ComboFix-quarantined-files.txt 2008-03-24 19:06:53 ComboFix2.txt 2008-03-24 14:26:35 . 2008-03-15 22:33:22 --- E O F ---

A tego programu nie kojarzę. Skasowac?

**Posty:** 8001 · przez **Okocza** 24 Mar 2008, 21:26

http://virusscan.jotti.org/ przeskanuj najpierw i zobacz co będzie. Wstaw raport.

**Posty:** 27 · przez **b0br** 24 Mar 2008, 21:39

Kod: Zaznacz wszystko: Service load: 0% 100% File: pcsd.dll Status: OK MD5: 83c3904f8515204f721d688f20f0d7ed Packers detected: - Bit9 reports: File not found Scanner results Scan taken on 24 Mar 2008 19:30:57 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Rising Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing

Wygląda na czysty.

**Posty:** 8001 · przez **Okocza** 24 Mar 2008, 21:40

możesz usunąć. to program do czyszczenia kompa.

panel sterowania - dodaj usuń programy - pc cleaner (usun) a jak nie to w katalogu powinienes miec uninstall

**Posty:** 27 · przez **b0br** 25 Mar 2008, 00:01

Dziekuje za pomoc. Wszystko dziala jak nalezy

proszę o sprawdzenie loga (popupy, blokada menadzera zadan)

Proszę o sprawdzenie loga (popupy, blokada menadzera zadan)

Kto jest na forum