Komp strasznie muli

**Posty:** 4 · przez **pio90** 27 Kwi 2009, 18:22

Proszę o sprawdzenie loga od pewnego czasu komputer chodzi bardzo wolno usunąłem robaki spyware doktor i nie pomogło antywirus nic nie wykrywa ! Zrobiłem wszystko co mogłem a na logach się nie znam.
Z góry dzięki za pomoc !
Hijack.

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:37:42, on 2009-04-27 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16827) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Google\Update\GoogleUpdate.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PSIService.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Documents and Settings\user\Menu Start\Programy\Autostart\Spyware Doctor Updater.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\WINDOWS\system32\PnkBstrB.exe C:\Documents and Settings\user\Pulpit\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://wyborcza.pl/0,0.html?p=005 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pajcomp.pl R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [Onet.pl AutoUpdate] "C:\Program Files\Common Files\Onet.pl\NewAutoUpdate.exe" /updateexetsr O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Corel File Shell Monitor] C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [RGSC] F:\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O4 - Startup: Spyware Doctor Updater.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: Zaznaczanie HP Smart - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: hgGwuvTn - hgGwuvTn.dll (file missing) O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Google Update Service (gupdate1c9a74b6ddfae32) (gupdate1c9a74b6ddfae32) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 10303 bytes

Combofix

Kod: Zaznacz wszystko: ComboFix 09-04-25.A3 - user 2009-04-27 16:55.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.48.1045.18.2047.1160 [GMT 2:00] Uruchomiony z: c:\documents and settings\user\Pulpit\ComboFix.exe AV: ESET NOD32 antivirus system 2.70 *On-access scanning enabled* (Updated) FW: ZoneAlarm Pro Firewall *enabled* * Utworzono nowy punkt przywracania * Resident AV is active UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\user\Dane aplikacji\.# c:\documents and settings\user\Dane aplikacji\.#\MBX@4D0@3D4198.### c:\documents and settings\user\Dane aplikacji\.#\MBX@4D0@3D41C8.### c:\documents and settings\user\Dane aplikacji\.#\MBX@4D0@3D41F8.### c:\documents and settings\user\Dane aplikacji\inst.exe c:\windows\hosts . ((((((((((((((((((((((((( Pliki utworzone od 2009-05-27 do 2009-4-27 ))))))))))))))))))))))))))))))) . 2009-04-16 12:55 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe 2009-04-16 12:55 . 2009-03-06 14:22 285696 -c----w c:\windows\system32\dllcache\pdh.dll 2009-04-16 12:55 . 2009-02-09 11:25 111104 -c----w c:\windows\system32\dllcache\services.exe 2009-04-16 12:55 . 2009-02-09 10:53 401408 -c----w c:\windows\system32\dllcache\rpcss.dll 2009-04-16 12:55 . 2009-02-09 10:53 473600 -c----w c:\windows\system32\dllcache\fastprox.dll 2009-04-16 12:55 . 2009-02-09 10:53 731136 -c----w c:\windows\system32\dllcache\lsasrv.dll 2009-04-16 12:55 . 2009-02-09 10:53 686592 -c----w c:\windows\system32\dllcache\advapi32.dll 2009-04-16 12:55 . 2009-02-09 10:53 722944 -c----w c:\windows\system32\dllcache\ntdll.dll 2009-04-16 12:55 . 2009-02-09 10:53 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll 2009-04-16 12:53 . 2008-04-21 21:16 218112 -c----w c:\windows\system32\dllcache\wordpad.exe 2009-04-04 10:32 . 2009-04-04 10:33 -------- d-----w c:\documents and settings\user\Dane aplikacji\SpeedSim 2009-03-30 15:40 . 2009-04-27 14:24 189072 ----a-w c:\windows\system32\PnkBstrB.xtr 2009-03-30 15:40 . 2009-04-27 14:24 189072 ----a-w c:\windows\system32\PnkBstrB.exe 2009-03-30 15:40 . 2009-03-30 15:40 -------- d-----w c:\documents and settings\user\Ustawienia lokalne\Dane aplikacji\PunkBuster 2009-03-29 20:38 . 2009-03-29 20:38 -------- d-----w c:\documents and settings\user\Dane aplikacji\AltrixSoft . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-27 15:00 . 2008-04-09 14:34 -------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-04-27 14:58 . 2008-12-05 21:07 428968 ----a-w c:\documents and settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat 2009-04-27 14:17 . 2008-08-28 15:27 138920 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2009-04-26 20:19 . 2008-04-17 16:03 -------- d-----w c:\program files\English Translator 3 2009-04-26 19:54 . 2009-03-19 15:27 -------- d-----w c:\documents and settings\user\Dane aplikacji\HPAppData 2009-04-22 05:08 . 2009-04-22 05:08 151778 ----a-w c:\windows\Internet Logs\vsmon_2nd_2009_04_22_07_06_40_small.dmp.zip 2009-04-22 05:06 . 2009-04-22 05:09 2874880 ----a-w c:\windows\Internet Logs\xDB23.tmp 2009-04-22 05:06 . 2009-04-22 05:08 2721280 ----a-w c:\windows\Internet Logs\xDB22.tmp 2009-04-21 18:51 . 2008-04-12 14:46 -------- d-----w c:\program files\PokerStars 2009-04-20 15:22 . 2008-04-08 13:53 -------- d--h--w c:\program files\InstallShield Installation Information 2009-04-17 04:58 . 2004-08-04 11:00 88224 ----a-w c:\windows\system32\perfc015.dat 2009-04-17 04:58 . 2004-08-04 11:00 497656 ----a-w c:\windows\system32\perfh015.dat 2009-04-13 19:34 . 2009-01-03 12:59 -------- d-----w c:\program files\Spyware Doctor 2009-04-12 17:19 . 2008-07-07 21:25 2568 --sha-w c:\windows\system32\KGyGaAvL.sys 2009-04-07 13:27 . 2008-04-09 16:55 -------- d-----w c:\program files\Java 2009-04-03 04:39 . 2008-06-18 09:03 12845034 ----a-w c:\windows\Internet Logs\tvDebug.zip 2009-04-01 10:47 . 2008-08-28 15:27 75064 ----a-w c:\windows\system32\PnkBstrA.exe 2009-04-01 10:36 . 2008-08-28 15:27 22328 -c--a-w c:\documents and settings\user\Dane aplikacji\PnkBstrK.sys 2009-03-17 22:00 . 2008-04-09 14:33 -------- d-----w c:\program files\Google 2009-03-13 07:24 . 2009-01-26 21:41 -------- d-----w c:\program files\Safari 2009-03-13 07:24 . 2008-04-08 18:49 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2009-03-10 07:40 . 2008-04-09 14:42 4212 ---ha-w c:\windows\system32\zllictbl.dat 2009-03-09 03:19 . 2008-11-22 23:41 410984 ----a-w c:\windows\system32\deploytk.dll 2009-03-08 19:12 . 2009-03-08 19:11 594 ----a-w C:\updatedatfix.log 2009-03-08 19:12 . 2009-03-07 18:28 -------- d-----w c:\program files\HP 2009-03-07 22:47 . 2009-03-07 22:47 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\HPSSUPPLY 2009-03-07 19:05 . 2009-03-07 19:05 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\WEBREG 2009-03-07 19:04 . 2009-03-07 19:04 -------- d-----w c:\documents and settings\user\Dane aplikacji\HP 2009-03-07 19:04 . 2009-03-07 18:50 178143 ----a-w c:\windows\hpoins28.dat 2009-03-07 18:57 . 2009-03-07 18:56 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\HP 2009-03-07 18:56 . 2009-03-07 18:56 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\HP Product Assistant 2009-03-07 18:55 . 2009-03-07 18:55 -------- d-----w c:\program files\Common Files\HP 2009-03-07 18:55 . 2009-03-07 18:55 -------- d-----w c:\program files\Hewlett-Packard 2009-03-07 18:55 . 2009-03-07 18:55 -------- d-----w c:\program files\Common Files\Hewlett-Packard 2009-03-07 18:24 . 2009-03-07 18:24 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Hewlett-Packard 2009-03-06 14:22 . 2004-08-04 11:00 285696 ----a-w c:\windows\system32\pdh.dll 2009-03-03 00:10 . 2008-03-28 13:34 826368 ----a-w c:\windows\system32\wininet.dll 2009-02-20 17:13 . 2008-03-28 13:33 78336 ----a-w c:\windows\system32\ieencode.dll 2009-02-09 14:07 . 2004-08-04 11:00 1847040 ----a-w c:\windows\system32\win32k.sys 2009-02-09 11:26 . 2004-08-04 00:39 2025472 ----a-w c:\windows\system32\ntkrnlpa.exe 2009-02-09 11:26 . 2004-08-04 11:00 2146816 ----a-w c:\windows\system32\ntoskrnl.exe 2009-02-09 11:25 . 2004-08-04 11:00 111104 ----a-w c:\windows\system32\services.exe 2009-02-09 10:53 . 2004-08-04 11:00 731136 ----a-w c:\windows\system32\lsasrv.dll 2009-02-09 10:53 . 2004-08-04 11:00 686592 ----a-w c:\windows\system32\advapi32.dll 2009-02-09 10:53 . 2004-08-04 11:00 401408 ----a-w c:\windows\system32\rpcss.dll 2009-02-09 10:53 . 2004-08-04 11:00 722944 ----a-w c:\windows\system32\ntdll.dll 2009-02-06 10:39 . 2004-08-04 11:00 35328 ----a-w c:\windows\system32\sc.exe 2009-02-04 11:23 . 2009-02-04 11:23 1700352 ----a-w c:\windows\system32\gdiplus.dll 2009-02-03 19:58 . 2004-08-04 11:00 56832 ----a-w c:\windows\system32\secur32.dll 2008-12-08 17:52 . 2008-04-08 17:28 73608 ----a-w c:\documents and settings\user\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2008-09-16 06:58 . 2008-09-16 06:58 129 ----a-w c:\documents and settings\user\Ustawienia lokalne\Dane aplikacji\fusioncache.dat 2008-07-30 19:51 . 2008-07-30 19:32 47360 -c--a-w c:\documents and settings\user\Dane aplikacji\pcouffin.sys 2008-04-19 16:10 . 2008-04-19 16:10 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat 2008-07-07 21:32 . 2008-07-07 21:32 88 --sh--r c:\windows\system32\8716732209.sys 2008-07-29 07:20 . 2008-04-08 13:25 16384 -csha-w c:\windows\system32\config\systemprofile\Cookies\index.dat 2008-07-29 07:20 . 2008-04-08 13:25 32768 -csha-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat 2008-07-29 07:20 . 2008-07-29 07:20 32768 -csha-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008072920080730\index.dat 2008-07-29 07:20 . 2008-04-08 13:25 32768 -csha-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "RGSC"="f:\rockstar games\Rockstar Games Social Club\RGSCLauncher.exe" [2008-12-13 306088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-11-12 13672448] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 56928] "LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 54832] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-04-08 155648] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-07-29 949376] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016] "Corel File Shell Monitor"="c:\program files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe" [2008-01-15 16200] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2006-11-23 487424] "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-08-21 981904] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-11-12 86016] "ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-08-25 1168264] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-03-25 49152] "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-09-19 16844800] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-11-12 1630208] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] c:\documents and settings\user\Menu Start\Programy\Autostart\ Spyware Doctor Updater.exe [2008-10-30 29228] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "e:\\Pro Evolution Soccer 2008\\PES2008.exe"= "e:\\Tom Clancy's Rainbow Six Vegas\\Binaries\\R6Vegas_Game.exe"= "e:\\Tom Clancy's Rainbow Six Vegas\\Binaries\\R6Vegas_Launcher.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\WINDOWS\\system32\\dpnsvr.exe"= "f:\\Downloads\\Programy\\uTorrent_1.7\\utorrent-1.7-rc6.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "e:\\Pro Evolution Soccer 2009\\PES 2009\\pes2009.exe"= "e:\\THE SETTLERS - Narodziny Imperium\\base\\bin\\Settlers6.exe"= "f:\\Gry\\Far Cry 2\\bin\\FarCry2.exe"= "f:\\Gry\\Far Cry 2\\bin\\FC2Launcher.exe"= "f:\\Gry\\Far Cry 2\\bin\\FC2Editor.exe"= "f:\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"= "f:\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"= "c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy2.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"= "e:\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "15766:TCP"= 15766:TCP:BitComet 15766 TCP "15766:UDP"= 15766:UDP:BitComet 15766 UDP R2 gupdate1c9a74b6ddfae32;Google Update Service (gupdate1c9a74b6ddfae32);c:\program files\Google\Update\GoogleUpdate.exe [2009-03-17 133104] S1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2008-07-29 15424] S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2008-09-12 95888] S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2008-09-12 41680] S2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-06-13 356920] --- Inne Usługi/Sterowniki w Pamięci --- *Deregistered* - mchInjDrv [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dc5db53c-24fd-11dd-a022-0019665bc14e}] \Shell\Auto\command - wupdmgr.exe \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wupdmgr.exe . Zawartość folderu 'Zaplanowane zadania' 2009-04-24 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2009-04-27 c:\windows\Tasks\GoogleUpdateTaskMachine.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-17 21:57] . - - - - USUNIĘTO PUSTE WPISY - - - - HKLM-Run-Onet.pl AutoUpdate - c:\program files\Common Files\Onet.pl\NewAutoUpdate.exe Notify-hgGwuvTn - hgGwuvTn.dll . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ mStart Page = hxxp://www.pajcomp.pl uInternet Connection Wizard,ShellNext = iexplore IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 LSP: imon.dll FF - ProfilePath - c:\documents and settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\3odvnuli.default\ FF - prefs.js: browser.startup.homepage - hxxp://pl.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:pl:official FF - plugin: c:\documents and settings\All Users\Dane aplikacji\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll FF - plugin: c:\program files\Google\Update\1.2.141.5\npGoogleOneClick7.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-27 17:02 Windows 5.1.2600 Dodatek Service Pack 3 NTFS detected NTDLL code modification: ZwClose skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-73586283-162531612-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) [HKEY_USERS\S-1-5-21-73586283-162531612-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:d7,ce,a3,94,07,b9,19,bd,f9,6b,ee,b9,6c,6d,71,40,f9,81,ef,a0,c1,9c,b8, 3b,fd,5c,f5,fa,bf,9f,37,a0,ec,a5,cd,56,31,1f,90,d7,71,75,67,fd,23,30,83,b4,\ "??"=hex:61,64,0a,3a,b2,e4,70,95,3e,a6,31,7a,54,51,aa,e3 [HKEY_USERS\S-1-5-21-73586283-162531612-839522115-1004\Software\SecuROM\License information*] "datasecu"=hex:7c,3f,7a,e3,17,7e,ef,a6,91,58,42,1d,b1,43,45,3c,c3,93,ad,2b,b0, 54,8d,a8,54,48,12,41,3a,5e,07,bb,8e,7d,be,9b,e5,7c,e5,e9,19,28,4d,6d,33,39,\ "rkeysecu"=hex:73,5a,b0,7d,da,e9,f5,14,21,32,03,74,a8,e3,5e,5b . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'lsass.exe'(944) c:\windows\system32\imon.dll - - - - - - - > 'explorer.exe'(1140) c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\ZoneLabs\vsmon.exe c:\program files\IVT Corporation\BlueSoleil\BTNtService.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\rundll32.exe c:\program files\ESET\nod32krn.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\PnkBstrA.exe c:\windows\system32\PnkBstrB.exe c:\windows\system32\PSIService.exe c:\program files\CyberLink\Shared Files\RichVideo.exe c:\program files\Spyware Doctor\pctsSvc.exe c:\documents and settings\user\Menu Start\Programy\Autostart\Spyware Doctor Updater.exe c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe c:\program files\HP\Digital Imaging\bin\hpqste08.exe c:\program files\HP\Digital Imaging\bin\hpqbam08.exe c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe . ************************************************************************** . Czas ukończenia: 2009-04-27 17:04 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-04-27 15:04 Przed: 21 544 534 016 bajtów wolnych Po: 21 547 651 072 bajtów wolnych 272 --- E O F --- 2009-04-17 00:17

**Posty:** 18165 · przez **wojtas** 27 Kwi 2009, 22:05

Wykonaj skan Dr. Web CureIt

oraz zastosuj sie do tego :

http://www.searchengines.pl/Infekcje-plikow-wykonywalnych-exe-dll-scr-t122692.html

chodzi o wirusa Virut

**Posty:** 4 · przez **pio90** 28 Kwi 2009, 17:12

Zrobiłem wszystko i nie pomogło

**Posty:** 18165 · przez **wojtas** 28 Kwi 2009, 17:36

daj nowego loga... z combofixa choc moze skonczyc sie to formatem wszystkich partycji.. poniewaz ten wirus infekuje pliki .exe

**Posty:** 4 · przez **pio90** 28 Kwi 2009, 21:07

Wątpię by to był wirus bo mam jeszcze zainstalowaną viste na innej partycji i pod nią działa wszystko jak należy !

**Posty:** 18165 · przez **wojtas** 28 Kwi 2009, 23:22

daj nowy log z combofixa

web cos znalazł??

**Posty:** 4 · przez **pio90** 29 Kwi 2009, 00:01

Web znalazł tylko kilka trojanow i robakow

Combofix

Kod: Zaznacz wszystko: ComboFix 09-04-27.03 - user 2009-04-28 23:54.5 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.48.1045.18.2047.1438 [GMT 2:00] Uruchomiony z: c:\documents and settings\user\Pulpit\ComboFix.exe AV: ESET NOD32 antivirus system 2.70 *On-access scanning enabled* (Updated) FW: ZoneAlarm Pro Firewall *enabled* * Resident AV is active UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((( Pliki utworzone od 2009-05-28 do 2009-4-28 ))))))))))))))))))))))))))))))) . 2009-04-28 19:38 . 2009-04-28 20:15 -------- d-----w c:\windows\BDOSCAN8 2009-04-27 20:22 . 2009-04-27 20:22 -------- d-----w c:\documents and settings\user\DoctorWeb 2009-04-16 12:55 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe 2009-04-16 12:55 . 2009-03-06 14:22 285696 -c----w c:\windows\system32\dllcache\pdh.dll 2009-04-16 12:55 . 2009-02-09 11:25 111104 -c----w c:\windows\system32\dllcache\services.exe 2009-04-16 12:55 . 2009-02-09 10:53 401408 -c----w c:\windows\system32\dllcache\rpcss.dll 2009-04-16 12:55 . 2009-02-09 10:53 473600 -c----w c:\windows\system32\dllcache\fastprox.dll 2009-04-16 12:55 . 2009-02-09 10:53 686592 -c----w c:\windows\system32\dllcache\advapi32.dll 2009-04-16 12:55 . 2009-02-09 10:53 731136 -c----w c:\windows\system32\dllcache\lsasrv.dll 2009-04-16 12:55 . 2009-02-09 10:53 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll 2009-04-16 12:55 . 2009-02-09 10:53 722944 -c----w c:\windows\system32\dllcache\ntdll.dll 2009-04-16 12:53 . 2008-04-21 21:16 218112 -c----w c:\windows\system32\dllcache\wordpad.exe 2009-04-04 10:32 . 2009-04-04 10:33 -------- d-----w c:\documents and settings\user\Dane aplikacji\SpeedSim 2009-03-30 15:40 . 2009-04-27 16:15 189072 ----a-w c:\windows\system32\PnkBstrB.exe 2009-03-30 15:40 . 2009-03-30 15:40 -------- d-----w c:\documents and settings\user\Ustawienia lokalne\Dane aplikacji\PunkBuster . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-28 18:08 . 2008-12-05 21:07 428968 ----a-w c:\documents and settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat 2009-04-28 15:11 . 2009-01-03 12:59 -------- d-----w c:\program files\Spyware Doctor 2009-04-27 16:06 . 2008-08-28 15:27 138920 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2009-04-27 15:23 . 2008-04-17 16:03 -------- d-----w c:\program files\English Translator 3 2009-04-22 05:08 . 2009-04-22 05:08 151778 ----a-w c:\windows\Internet Logs\vsmon_2nd_2009_04_22_07_06_40_small.dmp.zip 2009-04-22 05:06 . 2009-04-22 05:09 2874880 ----a-w c:\windows\Internet Logs\xDB23.tmp 2009-04-22 05:06 . 2009-04-22 05:08 2721280 ----a-w c:\windows\Internet Logs\xDB22.tmp 2009-04-21 18:51 . 2008-04-12 14:46 -------- d-----w c:\program files\PokerStars 2009-04-20 15:22 . 2008-04-08 13:53 -------- d--h--w c:\program files\InstallShield Installation Information 2009-04-17 04:58 . 2004-08-04 11:00 88224 ----a-w c:\windows\system32\perfc015.dat 2009-04-17 04:58 . 2004-08-04 11:00 497656 ----a-w c:\windows\system32\perfh015.dat 2009-04-12 17:19 . 2008-07-07 21:25 2568 --sha-w c:\windows\system32\KGyGaAvL.sys 2009-04-07 13:27 . 2008-04-09 16:55 -------- d-----w c:\program files\Java 2009-04-03 04:39 . 2008-06-18 09:03 12845034 ----a-w c:\windows\Internet Logs\tvDebug.zip 2009-04-01 10:47 . 2008-08-28 15:27 75064 ----a-w c:\windows\system32\PnkBstrA.exe 2009-04-01 10:36 . 2008-08-28 15:27 22328 -c--a-w c:\documents and settings\user\Dane aplikacji\PnkBstrK.sys 2009-03-17 22:00 . 2008-04-09 14:33 -------- d-----w c:\program files\Google 2009-03-13 07:24 . 2009-01-26 21:41 -------- d-----w c:\program files\Safari 2009-03-10 07:40 . 2008-04-09 14:42 4212 ---ha-w c:\windows\system32\zllictbl.dat 2009-03-09 03:19 . 2008-11-22 23:41 410984 ----a-w c:\windows\system32\deploytk.dll 2009-03-08 19:12 . 2009-03-07 18:28 -------- d-----w c:\program files\HP 2009-03-07 19:04 . 2009-03-07 18:50 178143 ----a-w c:\windows\hpoins28.dat 2009-03-07 18:55 . 2009-03-07 18:55 -------- d-----w c:\program files\Common Files\HP 2009-03-07 18:55 . 2009-03-07 18:55 -------- d-----w c:\program files\Hewlett-Packard 2009-03-07 18:55 . 2009-03-07 18:55 -------- d-----w c:\program files\Common Files\Hewlett-Packard 2009-03-06 14:22 . 2004-08-04 11:00 285696 ----a-w c:\windows\system32\pdh.dll 2009-03-03 00:10 . 2008-03-28 13:34 826368 ----a-w c:\windows\system32\wininet.dll 2009-02-20 17:13 . 2008-03-28 13:33 78336 ----a-w c:\windows\system32\ieencode.dll 2009-02-09 14:07 . 2004-08-04 11:00 1847040 ----a-w c:\windows\system32\win32k.sys 2009-02-09 11:26 . 2004-08-04 00:39 2025472 ----a-w c:\windows\system32\ntkrnlpa.exe 2009-02-09 11:26 . 2004-08-04 11:00 2146816 ----a-w c:\windows\system32\ntoskrnl.exe 2009-02-09 11:25 . 2004-08-04 11:00 111104 ----a-w c:\windows\system32\services.exe 2009-02-09 10:53 . 2004-08-04 11:00 731136 ----a-w c:\windows\system32\lsasrv.dll 2009-02-09 10:53 . 2004-08-04 11:00 686592 ----a-w c:\windows\system32\advapi32.dll 2009-02-09 10:53 . 2004-08-04 11:00 401408 ----a-w c:\windows\system32\rpcss.dll 2009-02-09 10:53 . 2004-08-04 11:00 722944 ----a-w c:\windows\system32\ntdll.dll 2009-02-06 10:39 . 2004-08-04 11:00 35328 ----a-w c:\windows\system32\sc.exe 2009-02-04 11:23 . 2009-02-04 11:23 1700352 ----a-w c:\windows\system32\gdiplus.dll 2009-02-03 19:58 . 2004-08-04 11:00 56832 ----a-w c:\windows\system32\secur32.dll 2008-07-07 21:32 . 2008-07-07 21:32 88 --sh--r c:\windows\system32\8716732209.sys . ((((((((((((((((((((((((((((( SnapShot@2009-04-27_15.02.48 ))))))))))))))))))))))))))))))))))))))))) . + 2009-04-28 21:47 . 2009-04-28 21:47 16384 c:\windows\Temp\Perflib_Perfdata_110.dat + 2001-07-14 15:32 . 2001-07-14 15:32 69632 c:\windows\setup.pss\setupupd\temp\wsdueng.dll + 2008-01-09 13:01 . 2008-01-09 13:01 53248 c:\windows\Downloaded Program Files\ipsupd.dll + 2008-01-09 13:01 . 2008-01-09 13:01 53248 c:\windows\bdoscandel.exe + 2009-04-28 19:39 . 2009-04-28 19:39 86016 c:\windows\BDOSCAN8\librtvr.dll + 2008-01-09 13:01 . 2008-01-09 13:01 53248 c:\windows\BDOSCAN8\ipsupd.dll + 2009-04-28 19:39 . 2009-04-28 19:39 27136 c:\windows\BDOSCAN8\avxt.dll + 2009-04-28 19:39 . 2009-04-28 19:39 10240 c:\windows\BDOSCAN8\avxs.dll + 2009-04-28 19:39 . 2009-04-28 19:39 45056 c:\windows\BDOSCAN8\avxdisk.dll + 2008-01-09 13:01 . 2008-01-09 13:01 118784 c:\windows\Downloaded Program Files\bdupd.dll + 2008-01-09 13:01 . 2009-04-28 19:39 142848 c:\windows\BDOSCAN8\libfn.dll + 2008-01-09 13:01 . 2008-01-09 13:01 118784 c:\windows\BDOSCAN8\bdupd.dll + 2008-01-09 13:01 . 2009-04-28 19:39 102400 c:\windows\BDOSCAN8\bdcore.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "RGSC"="f:\rockstar games\Rockstar Games Social Club\RGSCLauncher.exe" [2008-12-13 306088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-11-12 13672448] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 56928] "LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 54832] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-04-08 155648] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-07-29 949376] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016] "Corel File Shell Monitor"="c:\program files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe" [2008-01-15 16200] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2006-11-23 487424] "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-08-21 981904] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-11-12 86016] "ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-08-25 1168264] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-03-25 49152] "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-09-19 16844800] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-11-12 1630208] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] c:\documents and settings\user\Menu Start\Programy\Autostart\ Spyware Doctor Updater.exe [2008-10-30 29228] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "e:\\Pro Evolution Soccer 2008\\PES2008.exe"= "e:\\Tom Clancy's Rainbow Six Vegas\\Binaries\\R6Vegas_Game.exe"= "e:\\Tom Clancy's Rainbow Six Vegas\\Binaries\\R6Vegas_Launcher.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\WINDOWS\\system32\\dpnsvr.exe"= "f:\\Downloads\\Programy\\uTorrent_1.7\\utorrent-1.7-rc6.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "e:\\Pro Evolution Soccer 2009\\PES 2009\\pes2009.exe"= "e:\\THE SETTLERS - Narodziny Imperium\\base\\bin\\Settlers6.exe"= "f:\\Gry\\Far Cry 2\\bin\\FarCry2.exe"= "f:\\Gry\\Far Cry 2\\bin\\FC2Launcher.exe"= "f:\\Gry\\Far Cry 2\\bin\\FC2Editor.exe"= "f:\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"= "f:\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"= "c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy2.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"= "e:\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "15766:TCP"= 15766:TCP:BitComet 15766 TCP "15766:UDP"= 15766:UDP:BitComet 15766 UDP R2 gupdate1c9a74b6ddfae32;Google Update Service (gupdate1c9a74b6ddfae32);c:\program files\Google\Update\GoogleUpdate.exe [2009-03-17 133104] S1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2008-07-29 15424] S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2008-09-12 95888] S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2008-09-12 41680] S2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-06-13 356920] --- Inne Usługi/Sterowniki w Pamięci --- *Deregistered* - mchInjDrv [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Zawartość folderu 'Zaplanowane zadania' 2009-04-24 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2009-04-28 c:\windows\Tasks\GoogleUpdateTaskMachine.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-17 21:57] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ mStart Page = hxxp://www.pajcomp.pl uInternet Connection Wizard,ShellNext = iexplore IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 LSP: imon.dll FF - ProfilePath - c:\documents and settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\3odvnuli.default\ FF - prefs.js: browser.startup.homepage - hxxp://pl.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:pl:official FF - plugin: c:\documents and settings\All Users\Dane aplikacji\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll FF - plugin: c:\program files\Google\Update\1.2.141.5\npGoogleOneClick7.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-28 23:56 Windows 5.1.2600 Dodatek Service Pack 3 NTFS detected NTDLL code modification: ZwClose skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-73586283-162531612-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) [HKEY_USERS\S-1-5-21-73586283-162531612-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:d7,ce,a3,94,07,b9,19,bd,f9,6b,ee,b9,6c,6d,71,40,f9,81,ef,a0,c1,9c,b8, 3b,fd,5c,f5,fa,bf,9f,37,a0,ec,a5,cd,56,31,1f,90,d7,71,75,67,fd,23,30,83,b4,\ "??"=hex:61,64,0a,3a,b2,e4,70,95,3e,a6,31,7a,54,51,aa,e3 [HKEY_USERS\S-1-5-21-73586283-162531612-839522115-1004\Software\SecuROM\License information*] "datasecu"=hex:7c,3f,7a,e3,17,7e,ef,a6,91,58,42,1d,b1,43,45,3c,c3,93,ad,2b,b0, 54,8d,a8,54,48,12,41,3a,5e,07,bb,8e,7d,be,9b,e5,7c,e5,e9,19,28,4d,6d,33,39,\ "rkeysecu"=hex:73,5a,b0,7d,da,e9,f5,14,21,32,03,74,a8,e3,5e,5b . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'lsass.exe'(940) c:\windows\system32\imon.dll - - - - - - - > 'explorer.exe'(3148) c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . Czas ukończenia: 2009-04-28 23:57 ComboFix-quarantined-files.txt 2009-04-28 21:57 ComboFix2.txt 2009-04-28 07:21 ComboFix3.txt 2009-04-27 17:42 ComboFix4.txt 2009-04-27 17:22 ComboFix5.txt 2009-04-28 21:53 Przed: 20 973 559 808 bajtów wolnych Po: 20 969 185 280 bajtów wolnych 236 --- E O F --- 2009-04-17 00:17

**Posty:** 18165 · przez **wojtas** 29 Kwi 2009, 11:23

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef. oraz pokaz raport z weba.