Dziwny wirus

**Posty:** 391 · przez **Gacek89** 02 Mar 2009, 23:32

Kod: Zaznacz wszystko: Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! File "c:\documents and settings\Iza.GACEK\Dane aplikacji\twex.exe" deleted successfully. Folder "c:\documents and settings\Iza.GACEK\Dane aplikacji\twain32" deleted successfully. Completed script processing. ******************* Finished! Terminate.

Kod: Zaznacz wszystko: ComboFix 09-03-02.01 - Krzysiek 2009-03-02 22:24:37.11 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1023.322 [GMT 1:00] Uruchomiony z: c:\documents and settings\Krzysiek\Pulpit\ComboFix.exe AV: System Antywirusowy NOD32 2.51 *On-access scanning enabled* (Updated) FW: Outpost Firewall Pro *enabled* * Utworzono nowy punkt przywracania * Resident AV is active . ((((((((((((((((((((((((( Pliki utworzone od 2009-02-02 do 2009-03-02 ))))))))))))))))))))))))))))))) . 2009-02-27 21:23 . 2009-02-27 21:23 <DIR> d-------- C:\!KillBox 2009-02-23 01:24 . 2009-02-23 01:24 <DIR> d-------- C:\ERDNT 2009-02-23 01:24 . 2009-02-23 01:24 <DIR> d-------- C:\!FixIEDef 2009-02-22 11:18 . 2009-02-22 16:26 <DIR> d-------- c:\documents and settings\Krzysiek\DoctorWeb 2009-02-19 21:10 . 2009-02-19 21:11 <DIR> d-------- C:\HiJackThis 2009-02-19 19:27 . 2009-02-19 19:27 578,560 --a--c--- c:\windows\system32\dllcache\user32.dll 2009-02-18 23:19 . 2009-02-18 23:19 <DIR> d-------- c:\program files\SkanerOnline 2009-02-18 23:13 . 2009-02-18 23:13 <DIR> d-------- c:\windows\system32\Kaspersky Lab 2009-02-18 23:13 . 2009-02-18 23:13 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2009-02-16 22:20 . 2004-08-03 23:44 25,088 --a------ c:\windows\system32\userinit.exe 2009-02-06 00:34 . 2009-03-02 22:16 <DIR> d-------- c:\windows\system32\NtmsData . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-02 21:17 --------- d-----w c:\documents and settings\Krzysiek\Dane aplikacji\Dropbox 2009-02-28 18:10 --------- d-----w c:\documents and settings\Krzysiek\Dane aplikacji\MegauploadToolbar 2009-02-28 16:27 --------- d-----w c:\program files\Opera 2009-02-22 11:21 --------- d-----w c:\documents and settings\Iza.GACEK\Dane aplikacji\MEGAUPLOADTOOLBAR 2009-02-15 11:46 --------- d-----w c:\documents and settings\Krzysiek\Dane aplikacji\Skype 2009-02-15 11:19 --------- d-----w c:\documents and settings\Krzysiek\Dane aplikacji\skypePM 2009-02-10 15:05 --------- d-----w c:\program files\Common Files\Logitech 2009-01-21 16:11 473,600 ----a-w c:\windows\system32\SkanerOnline.dll 2009-01-11 20:50 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-11 20:50 --------- d-----w c:\program files\Leadtek Research Inc 2009-01-10 18:12 --------- d-----w c:\documents and settings\Iza.GACEK\Dane aplikacji\Teleca 2009-01-07 18:49 --------- d-----w c:\program files\ESET 2009-01-07 12:19 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\LogiShrd 2009-01-07 08:43 --------- d-----w c:\program files\Common Files\Logishrd 2009-01-07 08:40 --------- d-----w c:\documents and settings\Krzysiek\Dane aplikacji\InstallShield 2008-12-06 15:48 127,034 ------r c:\windows\bwUnin-8.1.1.50-8876480SL.exe 2006-05-03 09:06 163,328 --sh--r c:\windows\system32\flvDX.dll 2007-02-21 10:47 31,232 --sh--r c:\windows\system32\msfDX.dll . ((((((((((((((((((((((((((((( SnapShot@2009-03-02_17.02.19.46 ))))))))))))))))))))))))))))))))))))))))) . + 2009-03-02 21:13:38 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_330.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseSVN] @="{30351346-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351346-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseSVN] @="{30351347-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351347-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseSVN] @="{30351348-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351348-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseSVN] @="{3035134B-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134B-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseSVN] @="{3035134C-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134C-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseSVN] @="{3035134D-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134D-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseSVN] @="{3035134E-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134E-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2008-09-07 08:20 143360 --a------ d:\program files\Dropbox\DropboxExt.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2008-09-07 08:20 143360 --a------ d:\program files\Dropbox\DropboxExt.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2008-09-07 08:20 143360 --a------ d:\program files\Dropbox\DropboxExt.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Konnekt"="d:\konnekt\konnekt.exe" [2005-05-24 503808] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] "NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-04-04 81920] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2007-09-06 921600] "OutpostFeedBack"="c:\program files\Agnitum\Outpost Firewall\feedback.exe" [2006-05-11 356420] "Copy Handler"="c:\program files\Copy Handler\ch.exe" [2005-01-31 146432] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744] "amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 77824] "Outpost Firewall"="c:\program files\Agnitum\Outpost Firewall\outpost.exe" [2006-03-30 91648] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016] "!AVG Anti-Spyware"="d:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312] "RTHDCPL"="RTHDCPL.EXE" [2006-05-18 c:\windows\RTHDCPL.exe] "nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\Krzysiek\Menu Start\Programy\Autostart\ Dropbox.lnk - d:\program files\Dropbox\Dropbox.exe [2008-09-26 24096981] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ BOINC Manager.lnk - d:\program files\BOINC\boincmgr.exe [2008-03-04 4150016] Logitech Desktop Messenger.lnk - d:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-12-06 67128] Logitech SetPoint.lnk - d:\program files\Logitech\SetPoint\SetPoint.exe [2008-12-06 805392] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2008-05-02 02:42 72208 c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.I420"= i420vfw.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Krzysiek^Menu Start^Programy^Autostart^Adobe Gamma.lnk] path=c:\documents and settings\Krzysiek\Menu Start\Programy\Autostart\Adobe Gamma.lnk backup=c:\windows\pss\Adobe Gamma.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware] --a------ 2007-06-11 10:25 6731312 d:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-01-15 15:14 147456 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-03 23:44 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2008-03-20 11:04 2127296 d:\gadu-gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a--c--- 2006-10-26 23:47 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-02-19 13:10 267048 d:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-08-04 00:55 1667584 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a--c--- 2006-01-12 14:40 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune] --a------ 2007-04-04 13:20 81920 c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2008-10-07 13:33 86016 c:\windows\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odkurzacz-MCD] --a------ 2008-08-16 15:01 264704 d:\program files\Odkurzacz\odk_mcd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE] --a------ 2007-08-07 01:05 200704 d:\poweriso\PWRISOVM.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-01-31 23:13 385024 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoboForm] --a------ 2007-11-29 12:11 144448 d:\ai roboform\robotaskbaricon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a--c--- 2007-07-12 03:00 132496 c:\program files\Java\jre1.6.0_02\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2008-05-18 16:24 171448 c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2007-10-10 06:28 36352 d:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer] --a------ 2008-02-29 03:12 76304 c:\windows\KHALMNPR.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer] --a------ 2008-02-29 03:12 76304 c:\windows\KHALMNPR.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2008-10-07 13:33 1630208 c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel] -r---c--- 2006-05-16 11:04 2879488 c:\windows\SkyTel.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "d:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\WINDOWS\\system32\\LMabcoms.exe"= "d:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 VFILT;Outpost Firewall Kernel Driver;c:\program files\Agnitum\Outpost Firewall\Kernel\filtnt.sys [2007-09-10 125216] R2 pgsql-8.2;PostgreSQL Database Server 8.2;c:\program files\PostgreSQL\8.2\bin\pg_ctl.exe [2007-09-17 79948] R3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\adblock.dll [2007-09-10 33600] R3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\arp.dll [2007-09-10 17440] R3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\content.dll [2007-09-10 4896] R3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\dnscache.dll [2007-09-10 14304] R3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\ftpfilt.dll [2007-09-10 9024] R3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\htmlfilt.dll [2007-09-10 11552] R3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\httpfilt.dll [2007-09-10 13248] R3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\imapfilt.dll [2007-09-10 7200] R3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\mailfilt.dll [2007-09-10 14912] R3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\nntpfilt.dll [2007-09-10 6752] R3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\pop3filt.dll [2007-09-10 9984] R3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\protect.dll [2007-09-10 16960] R3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\secret.dll [2007-09-10 9696] S3 FoxAwdWINFLASH;FoxAwdWINFLASH;c:\program files\LiveUpdate\FoxAwdWINFLASH.sys [2006-01-01 4380] S3 KEYBOARDWDFilter;KEYBOARDWDFilter;c:\windows\system32\drivers\KEYBOARDWD.SYS [2007-11-17 6528] S3 NPF;WinPcap Packet Driver (NPF);c:\windows\system32\drivers\npf.sys [2007-11-06 34064] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J] \Shell\AutoRun\command - J:\Setup.exe -auto . Zawartość folderu 'Zaplanowane zadania' 2009-03-02 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57] 2009-03-02 c:\windows\Tasks\backup.job - c:\windows\system32\ntbackup.exe [2004-08-03 23:44] 2009-03-01 c:\windows\Tasks\Schedule Task Weekly.job - d:\program files\Registry Easy\RE.exe [] . . ------- Skan uzupełniający ------- . uInternet Settings,ProxyOverride = *.local uInternet Settings,ProxyServer = 165.91.83.23:3128 IE: &D&ownload &with BitComet - d:\bitcomet\BitComet.exe/AddLink.htm IE: &D&ownload all video with BitComet - d:\bitcomet\BitComet.exe/AddVideo.htm IE: &D&ownload all with BitComet - d:\bitcomet\BitComet.exe/AddAllLink.htm IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Pasek Narzędzi RoboForm - file://d:\ai roboform\RoboFormComShowToolbar.html IE: Personalizuj Menu - file://d:\ai roboform\RoboFormComCustomizeIEMenu.html IE: Wypełnij Pola - file://d:\ai roboform\RoboFormComFillForms.html IE: Zapisz Pola - file://d:\ai roboform\RoboFormComSavePass.html LSP: c:\windows\system32\imon.dll Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - d:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} - hxxp://www.eska.pl/streamplayers/OggX.ocx DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab FF - ProfilePath - c:\documents and settings\Krzysiek\Dane aplikacji\Mozilla\Firefox\Profiles\zsrau2p3.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p= FF - plugin: c:\program files\Mozilla Firefox\plugins\npOggX.dll FF - plugin: d:\program files\iTunes\Mozilla Plugins\npitunes.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-02 22:27:31 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-1957994488-1450960922-839522115-1003\Software\SecuROM\License information*] "datasecu"=hex:e6,fb,3d,3b,79,9b,a6,ff,be,9b,77,d9,b1,07,f1,98,72,34,dc,f5,0e, a3,fa,f0,e4,e4,a7,9b,11,00,f6,5e,f0,65,10,d0,02,c6,42,84,a2,66,ec,41,8a,a5,\ "rkeysecu"=hex:cd,b6,20,60,58,b7,73,a4,11,39,29,11,5e,d8,fc,c8 . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1292) c:\program files\common files\logitech\bluetooth\LBTWlgn.dll c:\program files\common files\logitech\bluetooth\LBTServ.dll . Czas ukończenia: 2009-03-02 22:29:31 ComboFix-quarantined-files.txt 2009-03-02 21:29:02 ComboFix2.txt 2009-03-02 16:03:23 Przed: 1 377 513 472 bajtów wolnych Po: 1,368,686,592 bajtów wolnych 267

**Posty:** 300 · przez **sgsman** 03 Mar 2009, 16:27

Opisz swój problem w temacie.

**Posty:** 18165 · przez **wojtas** 03 Mar 2009, 23:52

jest ok

**Posty:** 391 · przez **Gacek89** 08 Mar 2009, 15:01

moj komp jest zdony i znów sie zdu .....
minowicie przy logowaniu na profil uzytkownika nastepuje natychmiastowe wylogowanie, w awaryjnym smiga, cos musiało mi se dostac do koma i przy uruchomiwniu odrazu go wylogowuje aleniewiem co, odrazu zapodaje logami :

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:57:14, on 2009-03-08 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Boot mode: Safe mode with network support Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\TortoiseSVN\bin\TSVNCache.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\taskmgr.exe C:\WINDOWS\Explorer.exe C:\HiJackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 165.91.83.23:3128 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: (no name) - AutorunsDisabled - (no file) O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\BitComet\tools\BitCometBHO_1.1.8.30.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [OutpostFeedBack] C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup O4 - HKLM\..\Run: [Copy Handler] C:\Program Files\Copy Handler\ch.exe O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe O4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [LexPPS.exe] C:\WINDOWS\system32\lexpps.exe O4 - HKCU\..\Run: [Konnekt] "D:\Konnekt\konnekt.exe" /autostart O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Dropbox.lnk = D:\Program Files\Dropbox\Dropbox.exe O4 - Global Startup: BOINC Manager.lnk = D:\Program Files\BOINC\boincmgr.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = D:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - Global Startup: Logitech SetPoint.lnk = D:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Pasek Narzędzi RoboForm - file://D:\AI RoboForm\RoboFormComShowToolbar.html O8 - Extra context menu item: Personalizuj Menu - file://D:\AI RoboForm\RoboFormComCustomizeIEMenu.html O8 - Extra context menu item: Wypełnij Pola - file://D:\AI RoboForm\RoboFormComFillForms.html O8 - Extra context menu item: Zapisz Pola - file://D:\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: (no name) - AutorunsDisabled - (no file) O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\BitComet\tools\BitCometBHO_1.1.8.30.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} (OggX Control) - http://www.eska.pl/streamplayers/OggX.ocx O16 - DPF: {4EFA317A-8569-4788-B175-5BAF9731A549} (Microsoft Virtual Server VMRC Advanced Control) - https://www.microsoft.com/resources/virtuallabs/ActiveX/VMRCActiveXClient1.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - D:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: lmab_device - Unknown owner - C:\WINDOWS\system32\LMabcoms.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe O23 - Service: PostgreSQL Database Server 8.2 (pgsql-8.2) - PostgreSQL Global Development Group - C:\Program Files\PostgreSQL\8.2\bin\pg_ctl.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe -- End of file - 8542 bytes

Kod: Zaznacz wszystko: ComboFix 09-03-02.01 - Krzysiek 2009-03-08 13:50:02.12 - NTFSx86 NETWORK Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1023.777 [GMT 1:00] Uruchomiony z: c:\documents and settings\Krzysiek\Pulpit\ComboFix.exe AV: System Antywirusowy NOD32 2.51 *On-access scanning enabled* (Updated) FW: Outpost Firewall Pro *disabled* . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr0.dat c:\documents and settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr1.dat ----- BITS: Możliwe zainfekowane strony ----- hxxp://banksguard.com . ((((((((((((((((((((((((( Pliki utworzone od 2009-02-08 do 2009-03-08 ))))))))))))))))))))))))))))))) . 2009-03-05 19:37 . 2004-08-03 23:44 25,088 --a------ c:\windows\system32\stu2.exe 2009-03-04 23:21 . 2009-03-04 23:21 54,156 --ah----- c:\windows\QTFont.qfn 2009-03-04 23:21 . 2009-03-04 23:21 1,409 --a------ c:\windows\QTFont.for 2009-03-04 19:23 . 2009-03-04 19:23 <DIR> d-------- C:\jagoda 2009-02-27 21:23 . 2009-02-27 21:23 <DIR> d-------- C:\!KillBox 2009-02-23 01:24 . 2009-02-23 01:24 <DIR> d-------- C:\ERDNT 2009-02-23 01:24 . 2009-02-23 01:24 <DIR> d-------- C:\!FixIEDef 2009-02-22 11:18 . 2009-02-22 16:26 <DIR> d-------- c:\documents and settings\Krzysiek\DoctorWeb 2009-02-19 21:10 . 2009-02-19 21:11 <DIR> d-------- C:\HiJackThis 2009-02-19 19:27 . 2009-02-19 19:27 578,560 --a--c--- c:\windows\system32\dllcache\user32.dll 2009-02-18 23:19 . 2009-02-18 23:19 <DIR> d-------- c:\program files\SkanerOnline 2009-02-18 23:13 . 2009-02-18 23:13 <DIR> d-------- c:\windows\system32\Kaspersky Lab 2009-02-18 23:13 . 2009-02-18 23:13 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2009-02-16 22:20 . 2009-03-05 19:37 16,384 --a------ c:\windows\system32\userinit.exe . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-07 14:15 --------- d-----w c:\documents and settings\Krzysiek\Dane aplikacji\Dropbox 2009-03-05 14:50 --------- d-----w c:\documents and settings\Iza.GACEK\Dane aplikacji\MEGAUPLOADTOOLBAR 2009-03-04 23:03 --------- d-----w c:\documents and settings\Krzysiek\Dane aplikacji\MegauploadToolbar 2009-03-04 17:45 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-28 16:27 --------- d-----w c:\program files\Opera 2009-02-15 11:46 --------- d-----w c:\documents and settings\Krzysiek\Dane aplikacji\Skype 2009-02-15 11:19 --------- d-----w c:\documents and settings\Krzysiek\Dane aplikacji\skypePM 2009-02-10 15:05 --------- d-----w c:\program files\Common Files\Logitech 2009-01-21 16:11 473,600 ----a-w c:\windows\system32\SkanerOnline.dll 2009-01-11 20:50 --------- d-----w c:\program files\Leadtek Research Inc 2009-01-10 18:12 --------- d-----w c:\documents and settings\Iza.GACEK\Dane aplikacji\Teleca 2006-05-03 09:06 163,328 --sh--r c:\windows\system32\flvDX.dll 2007-02-21 10:47 31,232 --sh--r c:\windows\system32\msfDX.dll . ------- Sigcheck ------- 2009-03-05 19:37 16384 1e61929b9d68047c3cadca0234a5c321 c:\windows\system32\userinit.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseSVN] @="{30351346-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351346-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseSVN] @="{30351347-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351347-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseSVN] @="{30351348-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351348-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseSVN] @="{3035134B-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134B-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseSVN] @="{3035134C-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134C-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseSVN] @="{3035134D-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134D-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseSVN] @="{3035134E-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134E-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2008-09-07 08:20 143360 --a------ d:\program files\Dropbox\DropboxExt.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2008-09-07 08:20 143360 --a------ d:\program files\Dropbox\DropboxExt.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2008-09-07 08:20 143360 --a------ d:\program files\Dropbox\DropboxExt.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Konnekt"="d:\konnekt\konnekt.exe" [2005-05-24 503808] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] "NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-04-04 81920] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584] "Gadu-Gadu"="d:\gadu-gadu\gg.exe" [2008-03-20 2127296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2007-09-06 921600] "OutpostFeedBack"="c:\program files\Agnitum\Outpost Firewall\feedback.exe" [2006-05-11 356420] "Copy Handler"="c:\program files\Copy Handler\ch.exe" [2005-01-31 146432] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744] "amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 77824] "Outpost Firewall"="c:\program files\Agnitum\Outpost Firewall\outpost.exe" [2006-03-30 91648] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016] "!AVG Anti-Spyware"="d:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312] "LexPPS.exe"="c:\windows\system32\lexpps.exe" [2002-01-24 174592] "RTHDCPL"="RTHDCPL.EXE" [2006-05-18 c:\windows\RTHDCPL.exe] "nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\Krzysiek\Menu Start\Programy\Autostart\ Dropbox.lnk - d:\program files\Dropbox\Dropbox.exe [2008-09-26 24096981] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ BOINC Manager.lnk - d:\program files\BOINC\boincmgr.exe [2008-03-04 4150016] Logitech Desktop Messenger.lnk - d:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-12-06 67128] Logitech SetPoint.lnk - d:\program files\Logitech\SetPoint\SetPoint.exe [2008-12-06 805392] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2008-05-02 02:42 72208 c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.I420"= i420vfw.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Krzysiek^Menu Start^Programy^Autostart^Adobe Gamma.lnk] path=c:\documents and settings\Krzysiek\Menu Start\Programy\Autostart\Adobe Gamma.lnk backup=c:\windows\pss\Adobe Gamma.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware] --a------ 2007-06-11 10:25 6731312 d:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-01-15 15:14 147456 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-03 23:44 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2008-03-20 11:04 2127296 d:\gadu-gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a--c--- 2006-10-26 23:47 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-02-19 13:10 267048 d:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-08-04 00:55 1667584 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a--c--- 2006-01-12 14:40 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune] --a------ 2007-04-04 13:20 81920 c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2008-10-07 13:33 86016 c:\windows\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odkurzacz-MCD] --a------ 2008-08-16 15:01 264704 d:\program files\Odkurzacz\odk_mcd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE] --a------ 2007-08-07 01:05 200704 d:\poweriso\PWRISOVM.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-01-31 23:13 385024 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoboForm] --a------ 2007-11-29 12:11 144448 d:\ai roboform\robotaskbaricon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a--c--- 2007-07-12 03:00 132496 c:\program files\Java\jre1.6.0_02\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2008-05-18 16:24 171448 c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2007-10-10 06:28 36352 d:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer] --a------ 2008-02-29 03:12 76304 c:\windows\KHALMNPR.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer] --a------ 2008-02-29 03:12 76304 c:\windows\KHALMNPR.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2008-10-07 13:33 1630208 c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel] -r---c--- 2006-05-16 11:04 2879488 c:\windows\SkyTel.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "d:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\WINDOWS\\system32\\LMabcoms.exe"= "d:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 VFILT;Outpost Firewall Kernel Driver;c:\program files\Agnitum\Outpost Firewall\Kernel\filtnt.sys [2007-09-10 125216] S2 pgsql-8.2;PostgreSQL Database Server 8.2;c:\program files\PostgreSQL\8.2\bin\pg_ctl.exe [2007-09-17 79948] S3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\adblock.dll [2007-09-10 33600] S3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\arp.dll [2007-09-10 17440] S3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\content.dll [2007-09-10 4896] S3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\dnscache.dll [2007-09-10 14304] S3 FoxAwdWINFLASH;FoxAwdWINFLASH;c:\program files\LiveUpdate\FoxAwdWINFLASH.sys [2006-01-01 4380] S3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\ftpfilt.dll [2007-09-10 9024] S3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\htmlfilt.dll [2007-09-10 11552] S3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\httpfilt.dll [2007-09-10 13248] S3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\imapfilt.dll [2007-09-10 7200] S3 KEYBOARDWDFilter;KEYBOARDWDFilter;c:\windows\system32\drivers\KEYBOARDWD.SYS [2007-11-17 6528] S3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\mailfilt.dll [2007-09-10 14912] S3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\nntpfilt.dll [2007-09-10 6752] S3 NPF;WinPcap Packet Driver (NPF);c:\windows\system32\drivers\npf.sys [2007-11-06 34064] S3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\pop3filt.dll [2007-09-10 9984] S3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\protect.dll [2007-09-10 16960] S3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\secret.dll [2007-09-10 9696] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J] \Shell\AutoRun\command - J:\Setup.exe -auto . Zawartość folderu 'Zaplanowane zadania' 2009-03-02 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57] 2009-03-08 c:\windows\Tasks\backup.job - c:\windows\system32\ntbackup.exe [2004-08-03 23:44] 2009-03-01 c:\windows\Tasks\Schedule Task Weekly.job - d:\program files\Registry Easy\RE.exe [] . . ------- Skan uzupełniający ------- . uInternet Settings,ProxyOverride = *.local uInternet Settings,ProxyServer = 165.91.83.23:3128 IE: &D&ownload &with BitComet - d:\bitcomet\BitComet.exe/AddLink.htm IE: &D&ownload all video with BitComet - d:\bitcomet\BitComet.exe/AddVideo.htm IE: &D&ownload all with BitComet - d:\bitcomet\BitComet.exe/AddAllLink.htm IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Pasek Narzędzi RoboForm - file://d:\ai roboform\RoboFormComShowToolbar.html IE: Personalizuj Menu - file://d:\ai roboform\RoboFormComCustomizeIEMenu.html IE: Wypełnij Pola - file://d:\ai roboform\RoboFormComFillForms.html IE: Zapisz Pola - file://d:\ai roboform\RoboFormComSavePass.html LSP: c:\windows\system32\imon.dll Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - d:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} - hxxp://www.eska.pl/streamplayers/OggX.ocx DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab FF - ProfilePath - c:\documents and settings\Krzysiek\Dane aplikacji\Mozilla\Firefox\Profiles\zsrau2p3.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p= FF - plugin: c:\program files\Mozilla Firefox\plugins\npOggX.dll FF - plugin: d:\program files\iTunes\Mozilla Plugins\npitunes.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-08 13:52:33 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-1957994488-1450960922-839522115-1003\Software\SecuROM\License information*] "datasecu"=hex:e6,fb,3d,3b,79,9b,a6,ff,be,9b,77,d9,b1,07,f1,98,72,34,dc,f5,0e, a3,fa,f0,e4,e4,a7,9b,11,00,f6,5e,f0,65,10,d0,02,c6,42,84,a2,66,ec,41,8a,a5,\ "rkeysecu"=hex:cd,b6,20,60,58,b7,73,a4,11,39,29,11,5e,d8,fc,c8 . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1100) c:\program files\common files\logitech\bluetooth\LBTWlgn.dll c:\program files\common files\logitech\bluetooth\LBTServ.dll . Czas ukończenia: 2009-03-08 13:54:41 ComboFix-quarantined-files.txt 2009-03-08 12:53:47 ComboFix2.txt 2009-03-02 21:29:32 ComboFix3.txt 2009-03-02 16:03:23 Przed: 1 421 099 008 bajtów wolnych Po: 1,477,570,560 bajtów wolnych 272

**Posty:** 18165 · przez **wojtas** 08 Mar 2009, 16:49

sciagnij killbox’a

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

c:\windows\system32\stu2.exe

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

**Posty:** 391 · przez **Gacek89** 08 Mar 2009, 17:25

niepomogło ;/

Kod: Zaznacz wszystko: Pocket Killbox version 2.0.0.648 Running on Windows XP as Krzysiek(Administrator) was started @ niedziela, marzec 08, 2009, 4:14 PM # 1 [Delete on Reboot] Path = c:\windows\system32\stu2.exe I Rebooted @ 4:14:43 PM Killbox Closed(Exit) @ 4:14:51 PM __________________________________________________ Killbox Closed(Exit) @ 4:14:51 PM __________________________________________________

**Posty:** 18165 · przez **wojtas** 08 Mar 2009, 18:54

Otworz notatnik i wklej w nim to:

File::
c:\windows\system32\stu2.exe

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania

**Posty:** 391 · przez **Gacek89** 08 Mar 2009, 19:48

Kod: Zaznacz wszystko: ComboFix 09-03-02.01 - Krzysiek 2009-03-08 18:43:20.12 - NTFSx86 NETWORK Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1023.415 [GMT 1:00] Uruchomiony z: c:\documents and settings\Krzysiek\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\Krzysiek\Pulpit\CFScript.txt AV: System Antywirusowy NOD32 2.51 *On-access scanning enabled* (Updated) FW: Outpost Firewall Pro *enabled* FILE :: c:\windows\system32\stu2.exe . ((((((((((((((((((((((((( Pliki utworzone od 2009-02-08 do 2009-03-08 ))))))))))))))))))))))))))))))) . 2009-03-04 23:21 . 2009-03-04 23:21 54,156 --ah----- c:\windows\QTFont.qfn 2009-03-04 23:21 . 2009-03-04 23:21 1,409 --a------ c:\windows\QTFont.for 2009-03-04 19:23 . 2009-03-04 19:23 <DIR> d-------- C:\jagoda 2009-02-27 21:23 . 2009-02-27 21:23 <DIR> d-------- C:\!KillBox 2009-02-23 01:24 . 2009-02-23 01:24 <DIR> d-------- C:\ERDNT 2009-02-23 01:24 . 2009-02-23 01:24 <DIR> d-------- C:\!FixIEDef 2009-02-22 11:18 . 2009-02-22 16:26 <DIR> d-------- c:\documents and settings\Krzysiek\DoctorWeb 2009-02-19 21:10 . 2009-03-08 13:57 <DIR> d-------- C:\HiJackThis 2009-02-19 19:27 . 2009-02-19 19:27 578,560 --a--c--- c:\windows\system32\dllcache\user32.dll 2009-02-18 23:19 . 2009-02-18 23:19 <DIR> d-------- c:\program files\SkanerOnline 2009-02-18 23:13 . 2009-02-18 23:13 <DIR> d-------- c:\windows\system32\Kaspersky Lab 2009-02-18 23:13 . 2009-02-18 23:13 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2009-02-16 22:20 . 2009-03-05 19:37 16,384 --------- c:\windows\system32\userinit.exe . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-07 14:15 --------- d-----w c:\documents and settings\Krzysiek\Dane aplikacji\Dropbox 2009-03-05 14:50 --------- d-----w c:\documents and settings\Iza.GACEK\Dane aplikacji\MEGAUPLOADTOOLBAR 2009-03-04 23:03 --------- d-----w c:\documents and settings\Krzysiek\Dane aplikacji\MegauploadToolbar 2009-03-04 17:45 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-28 16:27 --------- d-----w c:\program files\Opera 2009-02-15 11:46 --------- d-----w c:\documents and settings\Krzysiek\Dane aplikacji\Skype 2009-02-15 11:19 --------- d-----w c:\documents and settings\Krzysiek\Dane aplikacji\skypePM 2009-02-10 15:05 --------- d-----w c:\program files\Common Files\Logitech 2009-01-21 16:11 473,600 ----a-w c:\windows\system32\SkanerOnline.dll 2009-01-11 20:50 --------- d-----w c:\program files\Leadtek Research Inc 2009-01-10 18:12 --------- d-----w c:\documents and settings\Iza.GACEK\Dane aplikacji\Teleca 2006-05-03 09:06 163,328 --sh--r c:\windows\system32\flvDX.dll 2007-02-21 10:47 31,232 --sh--r c:\windows\system32\msfDX.dll . ------- Sigcheck ------- 2009-03-05 19:37 16384 1e61929b9d68047c3cadca0234a5c321 c:\windows\system32\userinit.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseSVN] @="{30351346-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351346-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseSVN] @="{30351347-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351347-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseSVN] @="{30351348-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351348-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseSVN] @="{3035134B-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134B-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseSVN] @="{3035134C-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134C-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseSVN] @="{3035134D-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134D-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseSVN] @="{3035134E-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134E-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2008-09-07 08:20 143360 --a------ d:\program files\Dropbox\DropboxExt.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2008-09-07 08:20 143360 --a------ d:\program files\Dropbox\DropboxExt.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2008-09-07 08:20 143360 --a------ d:\program files\Dropbox\DropboxExt.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Konnekt"="d:\konnekt\konnekt.exe" [2005-05-24 503808] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] "NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-04-04 81920] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2007-09-06 921600] "OutpostFeedBack"="c:\program files\Agnitum\Outpost Firewall\feedback.exe" [2006-05-11 356420] "Copy Handler"="c:\program files\Copy Handler\ch.exe" [2005-01-31 146432] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744] "amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 77824] "Outpost Firewall"="c:\program files\Agnitum\Outpost Firewall\outpost.exe" [2006-03-30 91648] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016] "MSConfig"="c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2004-08-03 159744] "LexPPS.exe"="c:\windows\system32\lexpps.exe" [2002-01-24 174592] "RTHDCPL"="RTHDCPL.EXE" [2006-05-18 c:\windows\RTHDCPL.exe] "nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\Krzysiek\Menu Start\Programy\Autostart\ Dropbox.lnk - d:\program files\Dropbox\Dropbox.exe [2008-09-26 24096981] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ BOINC Manager.lnk - d:\program files\BOINC\boincmgr.exe [2008-03-04 4150016] Logitech Desktop Messenger.lnk - d:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-12-06 67128] Logitech SetPoint.lnk - d:\program files\Logitech\SetPoint\SetPoint.exe [2008-12-06 805392] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2008-05-02 02:42 72208 c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.I420"= i420vfw.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Krzysiek^Menu Start^Programy^Autostart^Adobe Gamma.lnk] path=c:\documents and settings\Krzysiek\Menu Start\Programy\Autostart\Adobe Gamma.lnk backup=c:\windows\pss\Adobe Gamma.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware] --a------ 2007-06-11 10:25 6731312 d:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-01-15 15:14 147456 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-03 23:44 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2008-03-20 11:04 2127296 d:\gadu-gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a--c--- 2006-10-26 23:47 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-02-19 13:10 267048 d:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LexPPS.exe] --a------ 2002-01-24 10:09 174592 c:\windows\system32\LEXPPS.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-08-04 00:55 1667584 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a--c--- 2006-01-12 14:40 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune] --a------ 2007-04-04 13:20 81920 c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2008-10-07 13:33 86016 c:\windows\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odkurzacz-MCD] --a------ 2008-08-16 15:01 264704 d:\program files\Odkurzacz\odk_mcd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE] --a------ 2007-08-07 01:05 200704 d:\poweriso\PWRISOVM.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-01-31 23:13 385024 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoboForm] --a------ 2007-11-29 12:11 144448 d:\ai roboform\robotaskbaricon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a--c--- 2007-07-12 03:00 132496 c:\program files\Java\jre1.6.0_02\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2008-05-18 16:24 171448 c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2007-10-10 06:28 36352 d:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer] --a------ 2008-02-29 03:12 76304 c:\windows\KHALMNPR.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer] --a------ 2008-02-29 03:12 76304 c:\windows\KHALMNPR.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2008-10-07 13:33 1630208 c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel] -r---c--- 2006-05-16 11:04 2879488 c:\windows\SkyTel.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "d:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\WINDOWS\\system32\\LMabcoms.exe"= "d:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 VFILT;Outpost Firewall Kernel Driver;c:\program files\Agnitum\Outpost Firewall\Kernel\filtnt.sys [2007-09-10 125216] S2 pgsql-8.2;PostgreSQL Database Server 8.2;c:\program files\PostgreSQL\8.2\bin\pg_ctl.exe [2007-09-17 79948] S3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\adblock.dll [2007-09-10 33600] S3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\arp.dll [2007-09-10 17440] S3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\content.dll [2007-09-10 4896] S3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\dnscache.dll [2007-09-10 14304] S3 FoxAwdWINFLASH;FoxAwdWINFLASH;c:\program files\LiveUpdate\FoxAwdWINFLASH.sys [2006-01-01 4380] S3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\ftpfilt.dll [2007-09-10 9024] S3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\htmlfilt.dll [2007-09-10 11552] S3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\httpfilt.dll [2007-09-10 13248] S3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\imapfilt.dll [2007-09-10 7200] S3 KEYBOARDWDFilter;KEYBOARDWDFilter;c:\windows\system32\drivers\KEYBOARDWD.SYS [2007-11-17 6528] S3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\mailfilt.dll [2007-09-10 14912] S3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\nntpfilt.dll [2007-09-10 6752] S3 NPF;WinPcap Packet Driver (NPF);c:\windows\system32\drivers\npf.sys [2007-11-06 34064] S3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\pop3filt.dll [2007-09-10 9984] S3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\protect.dll [2007-09-10 16960] S3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\secret.dll [2007-09-10 9696] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J] \Shell\AutoRun\command - J:\Setup.exe -auto [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{564d96ad-b65b-11dd-9e05-001558784796}] \Shell\AutoRun\command - I:\shellexec.exe index.html . Zawartość folderu 'Zaplanowane zadania' 2009-03-02 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57] 2009-03-08 c:\windows\Tasks\backup.job - c:\windows\system32\ntbackup.exe [2004-08-03 23:44] 2009-03-01 c:\windows\Tasks\Schedule Task Weekly.job - d:\program files\Registry Easy\RE.exe [] . . ------- Skan uzupełniający ------- . uInternet Settings,ProxyOverride = *.local uInternet Settings,ProxyServer = 165.91.83.23:3128 IE: &D&ownload &with BitComet - d:\bitcomet\BitComet.exe/AddLink.htm IE: &D&ownload all video with BitComet - d:\bitcomet\BitComet.exe/AddVideo.htm IE: &D&ownload all with BitComet - d:\bitcomet\BitComet.exe/AddAllLink.htm IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Pasek Narzędzi RoboForm - file://d:\ai roboform\RoboFormComShowToolbar.html IE: Personalizuj Menu - file://d:\ai roboform\RoboFormComCustomizeIEMenu.html IE: Wypełnij Pola - file://d:\ai roboform\RoboFormComFillForms.html IE: Zapisz Pola - file://d:\ai roboform\RoboFormComSavePass.html LSP: c:\windows\system32\imon.dll Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - d:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} - hxxp://www.eska.pl/streamplayers/OggX.ocx DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab FF - ProfilePath - c:\documents and settings\Krzysiek\Dane aplikacji\Mozilla\Firefox\Profiles\zsrau2p3.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p= FF - plugin: c:\program files\Mozilla Firefox\plugins\npOggX.dll FF - plugin: d:\program files\iTunes\Mozilla Plugins\npitunes.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-08 18:45:49 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-1957994488-1450960922-839522115-1003\Software\SecuROM\License information*] "datasecu"=hex:e6,fb,3d,3b,79,9b,a6,ff,be,9b,77,d9,b1,07,f1,98,72,34,dc,f5,0e, a3,fa,f0,e4,e4,a7,9b,11,00,f6,5e,f0,65,10,d0,02,c6,42,84,a2,66,ec,41,8a,a5,\ "rkeysecu"=hex:cd,b6,20,60,58,b7,73,a4,11,39,29,11,5e,d8,fc,c8 . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1104) c:\program files\common files\logitech\bluetooth\LBTWlgn.dll c:\program files\common files\logitech\bluetooth\LBTServ.dll . Czas ukończenia: 2009-03-08 18:47:19 ComboFix-quarantined-files.txt 2009-03-08 17:46:49 ComboFix2.txt 2009-03-08 12:54:42 ComboFix3.txt 2009-03-02 21:29:32 ComboFix4.txt 2009-03-02 16:03:23 Przed: 1 362 395 136 bajtów wolnych Po: 1,415,344,128 bajtów wolnych 270

**Posty:** 18165 · przez **wojtas** 08 Mar 2009, 20:07

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 391 · przez **Gacek89** 08 Mar 2009, 22:42

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.22.7514 * * * ******************************************************************************** Created at 21:05:06 on Sunday, March 08, 2009 Time Zone : Logged On User : Krzysiek Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2 OS Architecture : X86 System Langauge : Polish Keyboard Layout : Polish Processor : X64 AMD Athlon(tm) 64 X2 Dual Core Processor 4000+ System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 10 GB System Drive Free : 1.57 GB Total Physical Memory: 1023 MB Free Physical Memory : 397 MB Total Page File : 1023 MB Free Page File : 2607 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1959 MB Boot State : Fail-safe with network boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

Kod: Zaznacz wszystko: -------------------------------------------------------------------------------- RAPORT KASPERSKY ONLINE SCANNER 7.0 niedziela, 8 marzec 2009 System operacyjny: Microsoft Windows XP Professional Dodatek Service Pack 2 (build 2600) Wersja Kaspersky Online Scanner: 7.0.26.12 Data ostatniej aktualizacji bazy danych: Sunday, March 08, 2009 13:53:20 Liczba wpisów: 1880296 -------------------------------------------------------------------------------- Ustawienia skanowania: Typ bazy danych użytej do skanowania: rozszerzona Skanuj archiwa: tak Skanuj pocztowe bazy danych: tak Obszar skanowania - Folder: C:\WINDOWS\system32 Statystyki skanowania: Przeskanowanych plików: 4622 Nazwa zagrożenia: 1 Zainfekowanych obiektów: 1 Podejrzanych obiektów: 0 Czas skanowania: 00:05:10 Nazwa pliku / Nazwa zagrożenia / Liczba zagrożeń C:\WINDOWS\system32\userinit.exe Zainfekowany: Trojan.Win32.Inject.prt 1 Wybrany obszar został przeskanowany.

**Posty:** 18165 · przez **wojtas** 08 Mar 2009, 22:46

wejdz do konsoli odzyskiwania:

http://www.searchengines.pl/phpbb203/index.php?showtopic=14270

i wpisz:

expand X:\i386\userinit.ex_ C:\WINDOWS\system32\userinit.exe

X- literka Twojego cd romu

i daj nowy raport

**Posty:** 391 · przez **Gacek89** 08 Mar 2009, 23:30

zrobiłem niepomogło, był mały problem bo niechciało zastapic wiec zdekompresowałem do c:\windows a w awaryjnym zastapiłem we własciwej lokalizacji

**Posty:** 18165 · przez **wojtas** 08 Mar 2009, 23:31

daj nowy raport i log z combofixa

**Posty:** 391 · przez **Gacek89** 11 Mar 2009, 14:29

wszystko dobrze i jednoszczesnie nie, uciekły mi wszystkie ikony ;/

**Posty:** 18165 · przez **wojtas** 11 Mar 2009, 22:46

jak uciekly daj informacje jakieś..

**Posty:** 391 · przez **Gacek89** 24 Mar 2009, 17:54

te ikony sie juz naprawiły, ale mam inny problem znów z tym samym plikiem Zbiór c:\windows\system32\userinit.exe jest zainfekowany - trojan Win32/TrojanDownloader.FakeAlert.AAB. a przy włczaniu mam dziwny bład i musze recznie explorera włączyć;/

**Posty:** 8001 · przez **Okocza** 24 Mar 2009, 17:59

Gacek89, daj log z combo

**Posty:** 391 · przez **Gacek89** 24 Mar 2009, 18:57

Kod: Zaznacz wszystko: ComboFix 09-03-23.01 - Krzysiek 2009-03-24 17:48:45.13 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1023.242 [GMT 1:00] Uruchomiony z: c:\documents and settings\Krzysiek\Ustawienia lokalne\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download\ComboFix.exe AV: System Antywirusowy NOD32 2.51 *On-access scanning enabled* (Updated) FW: Outpost Firewall Pro *enabled* * Utworzono nowy punkt przywracania * Resident AV is active . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\userinit.exe . ((((((((((((((((((((((((( Pliki utworzone od 2009-02-24 do 2009-03-24 ))))))))))))))))))))))))))))))) . 2009-03-22 12:26 . 2004-08-04 01:44 25,088 --a------ c:\windows\system32\stu2.exe 2009-03-17 19:38 . 2009-03-17 19:38 <DIR> d-------- C:\w200_usb_signed_drivers 2009-03-17 19:38 . 2007-03-25 06:33 97,056 --a------ c:\windows\system32\drivers\w200mdm.sys 2009-03-17 19:38 . 2007-03-25 06:33 88,560 --a------ c:\windows\system32\drivers\w200mgmt.sys 2009-03-17 19:38 . 2007-03-25 06:33 86,368 --a------ c:\windows\system32\drivers\w200obex.sys 2009-03-17 19:38 . 2007-03-25 06:33 61,504 --a------ c:\windows\system32\drivers\w200bus.sys 2009-03-17 19:38 . 2007-03-25 06:33 9,328 --a------ c:\windows\system32\drivers\w200mdfl.sys 2009-03-17 19:38 . 2007-03-25 06:33 6,208 --a------ c:\windows\system32\drivers\w200cmnt.sys 2009-03-17 19:38 . 2007-03-25 06:33 6,208 --a------ c:\windows\system32\drivers\w200cm.sys 2009-03-17 19:38 . 2007-03-25 06:33 5,840 --a------ c:\windows\system32\drivers\w200whnt.sys 2009-03-17 19:38 . 2007-03-25 06:33 5,840 --a------ c:\windows\system32\drivers\w200wh.sys 2009-03-04 23:21 . 2009-03-04 23:21 54,156 --ah----- c:\windows\QTFont.qfn 2009-03-04 23:21 . 2009-03-04 23:21 1,409 --a------ c:\windows\QTFont.for 2009-03-04 19:23 . 2009-03-04 19:23 <DIR> d-------- C:\jagoda . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-24 13:51 --------- d-----w c:\documents and settings\Krzysiek\Dane aplikacji\Dropbox 2009-03-21 21:25 --------- d-----w c:\documents and settings\Krzysiek\Dane aplikacji\MegauploadToolbar 2009-03-19 17:13 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-03-19 14:00 --------- d-----w c:\documents and settings\Iza.GACEK\Dane aplikacji\MEGAUPLOADTOOLBAR 2009-03-14 08:47 --------- d-----w c:\program files\Opera 2009-03-12 11:52 --------- d-----w c:\program files\ESET 2009-03-04 17:45 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-18 22:19 --------- d-----w c:\program files\SkanerOnline 2009-02-18 22:13 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2009-02-15 11:46 --------- d-----w c:\documents and settings\Krzysiek\Dane aplikacji\Skype 2009-02-15 11:19 --------- d-----w c:\documents and settings\Krzysiek\Dane aplikacji\skypePM 2009-02-10 15:05 --------- d-----w c:\program files\Common Files\Logitech 2006-05-03 09:06 163,328 --sh--r c:\windows\system32\flvDX.dll 2007-02-21 10:47 31,232 --sh--r c:\windows\system32\msfDX.dll . ------- Sigcheck ------- md5deep: c:\windows\system32\userinit.exe: Permission denied . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseSVN] @="{30351346-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351346-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseSVN] @="{30351347-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351347-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseSVN] @="{30351348-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351348-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseSVN] @="{3035134B-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134B-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseSVN] @="{3035134C-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134C-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseSVN] @="{3035134D-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134D-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseSVN] @="{3035134E-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134E-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2008-09-07 08:20 143360 --a------ d:\program files\Dropbox\DropboxExt.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2008-09-07 08:20 143360 --a------ d:\program files\Dropbox\DropboxExt.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2008-09-07 08:20 143360 --a------ d:\program files\Dropbox\DropboxExt.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Konnekt"="d:\konnekt\konnekt.exe" [2005-05-24 503808] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2007-09-06 921600] "OutpostFeedBack"="c:\program files\Agnitum\Outpost Firewall\feedback.exe" [2006-05-11 356420] "Copy Handler"="c:\program files\Copy Handler\ch.exe" [2005-01-31 146432] "amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 77824] "Outpost Firewall"="c:\program files\Agnitum\Outpost Firewall\outpost.exe" [2006-03-30 91648] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-01-31 385024] "RTHDCPL"="RTHDCPL.EXE" [2006-05-18 c:\windows\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\Krzysiek\Menu Start\Programy\Autostart\ Dropbox.lnk - d:\program files\Dropbox\Dropbox.exe [2008-09-26 24096981] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ BOINC Manager.lnk - d:\program files\BOINC\boincmgr.exe [2008-03-04 4150016] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2008-05-02 02:42 72208 c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.I420"= i420vfw.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Logitech Desktop Messenger.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Logitech Desktop Messenger.lnk backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Logitech SetPoint.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Logitech SetPoint.lnk backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Krzysiek^Menu Start^Programy^Autostart^Adobe Gamma.lnk] path=c:\documents and settings\Krzysiek\Menu Start\Programy\Autostart\Adobe Gamma.lnk backup=c:\windows\pss\Adobe Gamma.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware] --a------ 2007-06-11 10:25 6731312 d:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-01-15 15:14 147456 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-03 23:44 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2008-03-20 11:04 2127296 d:\gadu-gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a--c--- 2006-10-26 23:47 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-02-19 13:10 267048 d:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LexPPS.exe] --a------ 2002-01-24 10:09 174592 c:\windows\system32\LEXPPS.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-08-04 00:55 1667584 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a--c--- 2006-01-12 14:40 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2008-10-07 13:33 13574144 c:\windows\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune] --a------ 2007-04-04 13:20 81920 c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2008-10-07 13:33 86016 c:\windows\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odkurzacz-MCD] --a------ 2008-08-16 15:01 264704 d:\program files\Odkurzacz\odk_mcd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE] --a------ 2007-08-07 01:05 200704 d:\poweriso\PWRISOVM.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-01-31 23:13 385024 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoboForm] --a------ 2007-11-29 12:11 144448 d:\ai roboform\robotaskbaricon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] -ra------ 2005-10-26 17:17 159744 c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a--c--- 2007-07-12 03:00 132496 c:\program files\Java\jre1.6.0_02\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2008-05-18 16:24 171448 c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2007-10-10 06:28 36352 d:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer] --a------ 2008-02-29 03:12 76304 c:\windows\KHALMNPR.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer] --a------ 2008-02-29 03:12 76304 c:\windows\KHALMNPR.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2008-10-07 13:33 1630208 c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel] -r---c--- 2006-05-16 11:04 2879488 c:\windows\SkyTel.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "d:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\WINDOWS\\system32\\LMabcoms.exe"= "d:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 VFILT;Outpost Firewall Kernel Driver;c:\program files\Agnitum\Outpost Firewall\Kernel\filtnt.sys [2007-09-10 125216] R2 pgsql-8.2;PostgreSQL Database Server 8.2;c:\program files\PostgreSQL\8.2\bin\pg_ctl.exe [2007-09-17 79948] R3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\adblock.dll [2007-09-10 33600] R3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\arp.dll [2007-09-10 17440] R3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\content.dll [2007-09-10 4896] R3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\dnscache.dll [2007-09-10 14304] R3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\ftpfilt.dll [2007-09-10 9024] R3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\htmlfilt.dll [2007-09-10 11552] R3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\httpfilt.dll [2007-09-10 13248] R3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\imapfilt.dll [2007-09-10 7200] R3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\mailfilt.dll [2007-09-10 14912] R3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\nntpfilt.dll [2007-09-10 6752] R3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\pop3filt.dll [2007-09-10 9984] R3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\protect.dll [2007-09-10 16960] R3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\secret.dll [2007-09-10 9696] S3 FoxAwdWINFLASH;FoxAwdWINFLASH;c:\program files\LiveUpdate\FoxAwdWINFLASH.sys [2006-01-01 4380] S3 KEYBOARDWDFilter;KEYBOARDWDFilter;c:\windows\system32\drivers\KEYBOARDWD.SYS [2007-11-17 6528] S3 NPF;WinPcap Packet Driver (NPF);c:\windows\system32\drivers\npf.sys [2007-11-06 34064] S3 w200bus;Sony Ericsson W200 driver (WDM);c:\windows\system32\drivers\w200bus.sys [2009-03-17 61504] S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;c:\windows\system32\drivers\w200mdfl.sys [2009-03-17 9328] S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;c:\windows\system32\drivers\w200mdm.sys [2009-03-17 97056] S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\w200mgmt.sys [2009-03-17 88560] S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;c:\windows\system32\drivers\w200obex.sys [2009-03-17 86368] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J] \Shell\AutoRun\command - J:\Setup.exe -auto [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\L] \Shell\AutoRun\command - L:\setup.exe . Zawartość folderu 'Zaplanowane zadania' 2009-03-16 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57] 2009-03-24 c:\windows\Tasks\backup.job - c:\windows\system32\ntbackup.exe [2004-08-03 23:44] 2009-03-22 c:\windows\Tasks\Schedule Task Weekly.job - d:\program files\Registry Easy\RE.exe [] . . ------- Skan uzupełniający ------- . uInternet Settings,ProxyOverride = *.local uInternet Settings,ProxyServer = 165.91.83.23:3128 IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Pasek Narzędzi RoboForm - file://d:\ai roboform\RoboFormComShowToolbar.html IE: Personalizuj Menu - file://d:\ai roboform\RoboFormComCustomizeIEMenu.html IE: Wypełnij Pola - file://d:\ai roboform\RoboFormComFillForms.html IE: Zapisz Pola - file://d:\ai roboform\RoboFormComSavePass.html LSP: c:\windows\system32\imon.dll Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - d:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} - hxxp://www.eska.pl/streamplayers/OggX.ocx DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab FF - ProfilePath - c:\documents and settings\Krzysiek\Dane aplikacji\Mozilla\Firefox\Profiles\zsrau2p3.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p= FF - plugin: c:\program files\Mozilla Firefox\plugins\npOggX.dll FF - plugin: d:\program files\iTunes\Mozilla Plugins\npitunes.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-24 17:51:59 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-1957994488-1450960922-839522115-1003\Software\SecuROM\License information*] "datasecu"=hex:e6,fb,3d,3b,79,9b,a6,ff,be,9b,77,d9,b1,07,f1,98,72,34,dc,f5,0e, a3,fa,f0,e4,e4,a7,9b,11,00,f6,5e,f0,65,10,d0,02,c6,42,84,a2,66,ec,41,8a,a5,\ "rkeysecu"=hex:cd,b6,20,60,58,b7,73,a4,11,39,29,11,5e,d8,fc,c8 . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1292) c:\program files\common files\logitech\bluetooth\LBTWlgn.dll c:\program files\common files\logitech\bluetooth\LBTServ.dll . Czas ukończenia: 2009-03-24 17:54:44 ComboFix-quarantined-files.txt 2009-03-24 16:54:21 Przed: 1 420 402 688 bajtów wolnych Po: 1,443,745,792 bajtów wolnych 277

**Posty:** 8001 · przez **Okocza** 24 Mar 2009, 19:02

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 391 · przez **Gacek89** 25 Mar 2009, 11:04

usunieto mi plik c:\windows\userinit.exe wiec moge pracowac tylko w awaryjnym ;/

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Krzysiek on 2009-03-25 at 10:07 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-25 10:17:16 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s0"=dword:5ab271a2 "s1"=dword:868217bc "s2"=dword:9f980ce3 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" "h0"=dword:00000000 "ujdew"=hex:0c,cf,e6,c5,a9,ad,d8,83,6b,d5,33,f5,12,23,56,85,82,d1,36,3a,02,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" "h0"=dword:00000000 "ujdew"=hex:0c,cf,e6,c5,a9,ad,d8,83,6b,d5,33,f5,12,23,56,85,82,d1,36,3a,02,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "D:\\Program Files\\iTunes\\iTunes.exe"="D:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove" "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote" "C:\\WINDOWS\\system32\\LMabcoms.exe"="C:\\WINDOWS\\system32\\LMabcoms.exe:*:Enabled:Lexmark Enhanced TCP/IP" "D:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="D:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "D:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="D:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Sun 8 Mar 2009 293 A.SHR --- "C:\Boot.bak" Tue 3 Aug 2004 60,928 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe" Wed 3 May 2006 163,328 ..SHR --- "C:\WINDOWS\system32\flvDX.dll" Wed 21 Feb 2007 31,232 ..SHR --- "C:\WINDOWS\system32\msfDX.dll" Wed 19 Nov 2008 444 ...HR --- "C:\Documents and Settings\Krzysiek\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak" Thu 19 Mar 2009 64,512 ...H. --- "C:\Documents and Settings\Krzysiek\Ustawienia lokalne\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download\~WRL0004.tmp" [b]Finished![/b]

Kod: Zaznacz wszystko: ComboFix 09-03-23.01 - Krzysiek 2009-03-25 10:23:59.14 - NTFSx86 NETWORK Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1023.482 [GMT 1:00] Uruchomiony z: c:\documents and settings\Krzysiek\Ustawienia lokalne\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download\ComboFix.exe AV: System Antywirusowy NOD32 2.51 *On-access scanning enabled* (Updated) FW: Outpost Firewall Pro *enabled* . ((((((((((((((((((((((((( Pliki utworzone od 2009-02-25 do 2009-03-25 ))))))))))))))))))))))))))))))) . 2009-03-25 10:04 . 2009-03-25 10:20 <DIR> d-------- C:\SDFix 2009-03-24 19:47 . 2009-03-24 19:47 <DIR> d-------- C:\JDownloader 0.4.936 2009-03-22 12:26 . 2004-08-04 01:44 25,088 --a------ c:\windows\system32\stu2.exe 2009-03-17 19:38 . 2009-03-17 19:38 <DIR> d-------- C:\w200_usb_signed_drivers 2009-03-17 19:38 . 2007-03-25 06:33 97,056 --a------ c:\windows\system32\drivers\w200mdm.sys 2009-03-17 19:38 . 2007-03-25 06:33 88,560 --a------ c:\windows\system32\drivers\w200mgmt.sys 2009-03-17 19:38 . 2007-03-25 06:33 86,368 --a------ c:\windows\system32\drivers\w200obex.sys 2009-03-17 19:38 . 2007-03-25 06:33 61,504 --a------ c:\windows\system32\drivers\w200bus.sys 2009-03-17 19:38 . 2007-03-25 06:33 9,328 --a------ c:\windows\system32\drivers\w200mdfl.sys 2009-03-17 19:38 . 2007-03-25 06:33 6,208 --a------ c:\windows\system32\drivers\w200cmnt.sys 2009-03-17 19:38 . 2007-03-25 06:33 6,208 --a------ c:\windows\system32\drivers\w200cm.sys 2009-03-17 19:38 . 2007-03-25 06:33 5,840 --a------ c:\windows\system32\drivers\w200whnt.sys 2009-03-17 19:38 . 2007-03-25 06:33 5,840 --a------ c:\windows\system32\drivers\w200wh.sys 2009-03-04 23:21 . 2009-03-04 23:21 54,156 --ah----- c:\windows\QTFont.qfn 2009-03-04 23:21 . 2009-03-04 23:21 1,409 --a------ c:\windows\QTFont.for 2009-03-04 19:23 . 2009-03-04 19:23 <DIR> d-------- C:\jagoda . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-24 13:51 --------- d-----w c:\documents and settings\Krzysiek\Dane aplikacji\Dropbox 2009-03-22 11:26 20,480 ----a-w c:\windows\system32\userinit.exe 2009-03-21 21:25 --------- d-----w c:\documents and settings\Krzysiek\Dane aplikacji\MegauploadToolbar 2009-03-19 17:13 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-03-19 14:00 --------- d-----w c:\documents and settings\Iza.GACEK\Dane aplikacji\MEGAUPLOADTOOLBAR 2009-03-14 08:47 --------- d-----w c:\program files\Opera 2009-03-12 11:52 --------- d-----w c:\program files\ESET 2009-03-04 17:45 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-18 22:19 --------- d-----w c:\program files\SkanerOnline 2009-02-18 22:13 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2009-02-15 11:46 --------- d-----w c:\documents and settings\Krzysiek\Dane aplikacji\Skype 2009-02-15 11:19 --------- d-----w c:\documents and settings\Krzysiek\Dane aplikacji\skypePM 2009-02-10 15:05 --------- d-----w c:\program files\Common Files\Logitech 2009-01-21 16:11 473,600 ----a-w c:\windows\system32\SkanerOnline.dll 2006-05-03 09:06 163,328 --sh--r c:\windows\system32\flvDX.dll 2007-02-21 10:47 31,232 --sh--r c:\windows\system32\msfDX.dll . ------- Sigcheck ------- 2009-03-22 12:26 20480 c0b3fd34f5ec4498212a0aa13752d13c c:\windows\system32\userinit.exe . ((((((((((((((((((((((((((((( SnapShot@2009-03-24_17.53.34,35 ))))))))))))))))))))))))))))))))))))))))) . - 2009-02-19 18:25:37 6,725,632 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2009-03-25 09:05:30 6,832,128 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\ntuser.dat - 2009-02-19 18:25:37 376,832 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2009-03-25 09:05:30 376,832 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseSVN] @="{30351346-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351346-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseSVN] @="{30351347-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351347-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseSVN] @="{30351348-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351348-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseSVN] @="{3035134B-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134B-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseSVN] @="{3035134C-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134C-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseSVN] @="{3035134D-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134D-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseSVN] @="{3035134E-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134E-7B7D-4FCC-81B4-1E394CA267EB}] 2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2008-09-07 08:20 143360 --a------ d:\program files\Dropbox\DropboxExt.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2008-09-07 08:20 143360 --a------ d:\program files\Dropbox\DropboxExt.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2008-09-07 08:20 143360 --a------ d:\program files\Dropbox\DropboxExt.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Konnekt"="d:\konnekt\konnekt.exe" [2005-05-24 503808] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2007-09-06 921600] "OutpostFeedBack"="c:\program files\Agnitum\Outpost Firewall\feedback.exe" [2006-05-11 356420] "Copy Handler"="c:\program files\Copy Handler\ch.exe" [2005-01-31 146432] "amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 77824] "Outpost Firewall"="c:\program files\Agnitum\Outpost Firewall\outpost.exe" [2006-03-30 91648] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-01-31 385024] "LexPPS.exe"="c:\windows\system32\lexpps.exe" [2002-01-24 174592] "RTHDCPL"="RTHDCPL.EXE" [2006-05-18 c:\windows\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\Krzysiek\Menu Start\Programy\Autostart\ Dropbox.lnk - d:\program files\Dropbox\Dropbox.exe [2008-09-26 24096981] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ BOINC Manager.lnk - d:\program files\BOINC\boincmgr.exe [2008-03-04 4150016] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2008-05-02 02:42 72208 c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.I420"= i420vfw.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Logitech Desktop Messenger.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Logitech Desktop Messenger.lnk backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Logitech SetPoint.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Logitech SetPoint.lnk backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Krzysiek^Menu Start^Programy^Autostart^Adobe Gamma.lnk] path=c:\documents and settings\Krzysiek\Menu Start\Programy\Autostart\Adobe Gamma.lnk backup=c:\windows\pss\Adobe Gamma.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware] --a------ 2007-06-11 10:25 6731312 d:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-01-15 15:14 147456 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-03 23:44 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2008-03-20 11:04 2127296 d:\gadu-gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a--c--- 2006-10-26 23:47 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-02-19 13:10 267048 d:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LexPPS.exe] --a------ 2002-01-24 10:09 174592 c:\windows\system32\LEXPPS.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-08-04 00:55 1667584 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a--c--- 2006-01-12 14:40 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2008-10-07 13:33 13574144 c:\windows\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune] --a------ 2007-04-04 13:20 81920 c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2008-10-07 13:33 86016 c:\windows\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odkurzacz-MCD] --a------ 2008-08-16 15:01 264704 d:\program files\Odkurzacz\odk_mcd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE] --a------ 2007-08-07 01:05 200704 d:\poweriso\PWRISOVM.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-01-31 23:13 385024 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoboForm] --a------ 2007-11-29 12:11 144448 d:\ai roboform\robotaskbaricon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] -ra------ 2005-10-26 17:17 159744 c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a--c--- 2007-07-12 03:00 132496 c:\program files\Java\jre1.6.0_02\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2008-05-18 16:24 171448 c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2007-10-10 06:28 36352 d:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer] --a------ 2008-02-29 03:12 76304 c:\windows\KHALMNPR.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer] --a------ 2008-02-29 03:12 76304 c:\windows\KHALMNPR.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2008-10-07 13:33 1630208 c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel] -r---c--- 2006-05-16 11:04 2879488 c:\windows\SkyTel.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "d:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\WINDOWS\\system32\\LMabcoms.exe"= "d:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 VFILT;Outpost Firewall Kernel Driver;c:\program files\Agnitum\Outpost Firewall\Kernel\filtnt.sys [2007-09-10 125216] S2 pgsql-8.2;PostgreSQL Database Server 8.2;c:\program files\PostgreSQL\8.2\bin\pg_ctl.exe [2007-09-17 79948] S3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\adblock.dll [2007-09-10 33600] S3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\arp.dll [2007-09-10 17440] S3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\content.dll [2007-09-10 4896] S3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\dnscache.dll [2007-09-10 14304] S3 FoxAwdWINFLASH;FoxAwdWINFLASH;c:\program files\LiveUpdate\FoxAwdWINFLASH.sys [2006-01-01 4380] S3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\ftpfilt.dll [2007-09-10 9024] S3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\htmlfilt.dll [2007-09-10 11552] S3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\httpfilt.dll [2007-09-10 13248] S3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\imapfilt.dll [2007-09-10 7200] S3 KEYBOARDWDFilter;KEYBOARDWDFilter;c:\windows\system32\drivers\KEYBOARDWD.SYS [2007-11-17 6528] S3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\mailfilt.dll [2007-09-10 14912] S3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\nntpfilt.dll [2007-09-10 6752] S3 NPF;WinPcap Packet Driver (NPF);c:\windows\system32\drivers\npf.sys [2007-11-06 34064] S3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\pop3filt.dll [2007-09-10 9984] S3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\protect.dll [2007-09-10 16960] S3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL);c:\program files\Agnitum\Outpost Firewall\Kernel\secret.dll [2007-09-10 9696] S3 w200bus;Sony Ericsson W200 driver (WDM);c:\windows\system32\drivers\w200bus.sys [2009-03-17 61504] S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;c:\windows\system32\drivers\w200mdfl.sys [2009-03-17 9328] S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;c:\windows\system32\drivers\w200mdm.sys [2009-03-17 97056] S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\w200mgmt.sys [2009-03-17 88560] S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;c:\windows\system32\drivers\w200obex.sys [2009-03-17 86368] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J] \Shell\AutoRun\command - J:\Setup.exe -auto . Zawartość folderu 'Zaplanowane zadania' 2009-03-16 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57] 2009-03-25 c:\windows\Tasks\backup.job - c:\windows\system32\ntbackup.exe [2004-08-03 23:44] 2009-03-22 c:\windows\Tasks\Schedule Task Weekly.job - d:\program files\Registry Easy\RE.exe [] . . ------- Skan uzupełniający ------- . uInternet Settings,ProxyOverride = *.local uInternet Settings,ProxyServer = 165.91.83.23:3128 IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Pasek Narzędzi RoboForm - file://d:\ai roboform\RoboFormComShowToolbar.html IE: Personalizuj Menu - file://d:\ai roboform\RoboFormComCustomizeIEMenu.html IE: Wypełnij Pola - file://d:\ai roboform\RoboFormComFillForms.html IE: Zapisz Pola - file://d:\ai roboform\RoboFormComSavePass.html LSP: c:\windows\system32\imon.dll Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - d:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} - hxxp://www.eska.pl/streamplayers/OggX.ocx DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab FF - ProfilePath - c:\documents and settings\Krzysiek\Dane aplikacji\Mozilla\Firefox\Profiles\zsrau2p3.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p= FF - plugin: c:\program files\Mozilla Firefox\plugins\npOggX.dll FF - plugin: d:\program files\iTunes\Mozilla Plugins\npitunes.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-25 10:24:50 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-1957994488-1450960922-839522115-1003\Software\SecuROM\License information*] "datasecu"=hex:e6,fb,3d,3b,79,9b,a6,ff,be,9b,77,d9,b1,07,f1,98,72,34,dc,f5,0e, a3,fa,f0,e4,e4,a7,9b,11,00,f6,5e,f0,65,10,d0,02,c6,42,84,a2,66,ec,41,8a,a5,\ "rkeysecu"=hex:cd,b6,20,60,58,b7,73,a4,11,39,29,11,5e,d8,fc,c8 . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1100) c:\program files\common files\logitech\bluetooth\LBTWlgn.dll c:\program files\common files\logitech\bluetooth\LBTServ.dll . Czas ukończenia: 2009-03-25 10:26:16 ComboFix-quarantined-files.txt 2009-03-25 09:25:42 ComboFix2.txt 2009-03-24 16:54:45 Przed: 1 525 862 400 bajtów wolnych Po: 1,513,189,376 bajtów wolnych 282

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:29:45, on 2009-03-25 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Boot mode: Safe mode with network support Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\TortoiseSVN\bin\TSVNCache.exe C:\Program Files\Opera\Opera.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Krzysiek\Ustawienia lokalne\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 165.91.83.23:3128 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: (no name) - AutorunsDisabled - (no file) O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\BitComet\tools\BitCometBHO_1.1.8.30.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [OutpostFeedBack] C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup O4 - HKLM\..\Run: [Copy Handler] C:\Program Files\Copy Handler\ch.exe O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe O4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [LexPPS.exe] C:\WINDOWS\system32\lexpps.exe O4 - HKCU\..\Run: [Konnekt] "D:\Konnekt\konnekt.exe" /autostart O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Dropbox.lnk = D:\Program Files\Dropbox\Dropbox.exe O4 - Global Startup: BOINC Manager.lnk = D:\Program Files\BOINC\boincmgr.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Pasek Narzędzi RoboForm - file://D:\AI RoboForm\RoboFormComShowToolbar.html O8 - Extra context menu item: Personalizuj Menu - file://D:\AI RoboForm\RoboFormComCustomizeIEMenu.html O8 - Extra context menu item: Wypełnij Pola - file://D:\AI RoboForm\RoboFormComFillForms.html O8 - Extra context menu item: Zapisz Pola - file://D:\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: (no name) - AutorunsDisabled - (no file) O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\BitComet\tools\BitCometBHO_1.1.8.30.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} (OggX Control) - http://www.eska.pl/streamplayers/OggX.ocx O16 - DPF: {4EFA317A-8569-4788-B175-5BAF9731A549} (Microsoft Virtual Server VMRC Advanced Control) - https://www.microsoft.com/resources/virtuallabs/ActiveX/VMRCActiveXClient1.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - D:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: lmab_device - Unknown owner - C:\WINDOWS\system32\LMabcoms.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe O23 - Service: PostgreSQL Database Server 8.2 (pgsql-8.2) - PostgreSQL Global Development Group - C:\Program Files\PostgreSQL\8.2\bin\pg_ctl.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe -- End of file - 7577 bytes

Dziwny wirus

Dziwny wirus

Dziwny wirus

Dziwny wirus

Re: dziwny wirus

Dziwny wirus

Re: dziwny wirus

Dziwny wirus

Dziwny wirus

Dziwny wirus

Dziwny wirus

Dziwny wirus

Dziwny wirus

Dziwny wirus

Dziwny wirus

Dziwny wirus

Dziwny wirus

Dziwny wirus

Dziwny wirus

Dziwny wirus

Dziwny wirus

Kto jest na forum