Pomocy !! win32:trojan-gen. {other}

**Posty:** 8 · przez **LikeThis** 21 Kwi 2009, 18:23

Witam
Jak usunąć win32:trojan-gen. {other}
help
Oto wpis Hijackthis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:21:20, on 2009-04-21 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\VM305_STI.EXE C:\Program Files\Java\jre6\bin\jusched.exe C:\program files\relevantknowledge\rlvknlg.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\WINDOWS\system32\wbem\unsecapp.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Alwil Software\Avast4\ashSimpl.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\NOTEPAD.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305) O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [RelevantKnowledge] C:\program files\relevantknowledge\rlvknlg.exe -boot O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O17 - HKLM\System\CCS\Services\Tcpip\..\{874AB105-4D52-4A41-8B7B-EF3F7E13DF65}: NameServer = 213.241.79.37 83.238.255.76 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 6026 bytes

Log z ComboFix :

Kod: Zaznacz wszystko: ComboFix 09-04-21.A7 - Daniel 2009-04-21 20:04.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.510.109 [GMT 2:00] Uruchomiony z: c:\documents and settings\Daniel\Pulpit\ComboFix.exe AV: avast! antivirus 4.8.1335 [VPS 090421-0] *On-access scanning disabled* (Updated) * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Autorun.inf c:\documents and settings\Daniel\Daniel.exe C:\ej10fkdo.bat c:\windows\system32\28463 c:\windows\system32\28463\AKV.exe c:\windows\system32\28463\EWYL.001 c:\windows\system32\28463\EWYL.002 c:\windows\system32\28463\EWYL.005 c:\windows\system32\28463\EWYL.006 c:\windows\system32\kr_done1 c:\windows\system32\nmdfgds0.dll c:\windows\system32\nmdfgds1.dll c:\windows\system32\olhrwef.exe D:\Autorun.inf D:\ej10fkdo.bat E:\Autorun.inf E:\ej10fkdo.bat . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_OREANS32 -------\Service_oreans32 ((((((((((((((((((((((((( Pliki utworzone od 2009-03-21 do 2009-04-21 ))))))))))))))))))))))))))))))) . 2009-04-21 18:09 . 2009-04-21 18:09 -------- d-----w c:\windows\system32\xircom 2009-04-21 18:09 . 2009-04-21 18:09 -------- d-----w c:\program files\microsoft frontpage 2009-04-21 17:42 . 2009-04-21 17:42 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\vlc 2009-04-20 21:03 . 2009-04-20 21:03 -------- d-----w c:\program files\Damian Pasternak 2009-04-20 19:59 . 2009-04-20 20:00 460173 ----a-w C:\R0420__21_59_52.mp3 2009-04-20 19:46 . 2009-04-20 21:10 -------- d-----w c:\program files\RelevantKnowledge 2009-04-20 16:01 . 2009-04-20 16:01 -------- d-----w c:\documents and settings\Daniel\Ustawienia lokalne\Dane aplikacji\Stardock 2009-04-20 15:59 . 2009-04-20 15:59 36913 ----a-w c:\windows\BricoPackUninst.cmd 2009-04-20 15:57 . 2009-04-20 15:57 3932214 ----a-w c:\windows\BricoPack Wallpaper.bmp 2009-04-20 15:54 . 2009-04-20 15:59 2155 ----a-w c:\windows\BricoPackFoldersDelete.cmd 2009-04-20 15:53 . 2009-04-20 15:53 -------- d-----w c:\windows\BricoPacks 2009-04-19 23:58 . 2009-04-19 23:58 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\OpenFM 2009-04-19 23:14 . 2009-04-20 20:29 -------- d-----w c:\windows\Icons 2009-04-19 22:50 . 2009-04-20 17:00 -------- d-----w c:\program files\Mozilla Firefox 3.1 Beta 3 2009-04-19 21:57 . 2009-04-19 21:57 -------- d-----w c:\program files\VideoLAN 2009-04-19 19:28 . 2009-04-19 19:28 -------- d-----w c:\program files\Trend Micro 2009-04-19 19:23 . 2009-04-19 19:23 -------- d-----w C:\!KillBox 2009-04-19 19:12 . 2009-04-20 16:29 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\Nowe Gadu-Gadu 2009-04-19 15:26 . 2009-04-19 15:26 73728 ----a-w c:\windows\system32\javacpl.cpl 2009-04-18 20:27 . 2009-04-19 21:50 -------- d-----w C:\TEMP 2009-04-18 20:04 . 2003-03-18 19:20 1060864 ----a-w c:\windows\system32\MFC71.dll 2009-04-18 20:04 . 2003-03-18 18:14 499712 ----a-w c:\windows\system32\MSVCP71.dll 2009-04-18 20:04 . 2009-04-18 20:04 -------- d-----w c:\program files\Alwil Software 2009-04-18 19:46 . 2002-01-05 13:37 344064 ----a-w c:\windows\system32\msvcr70.dll 2009-04-18 19:34 . 2009-04-18 20:30 -------- d-----w c:\program files\Total Video Converter 2009-04-18 13:07 . 2009-04-18 13:07 -------- d-----w c:\documents and settings\Daniel\Ustawienia lokalne\Dane aplikacji\vdownloader 2009-04-18 13:07 . 2009-04-18 13:59 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\Desktopicon 2009-04-16 20:54 . 2009-04-17 15:50 -------- d-----w c:\documents and settings\Daniel\.gimp-2.6 2009-04-16 20:54 . 2009-04-16 20:54 -------- d-----w c:\documents and settings\Daniel\.gegl-0.0 2009-04-16 20:53 . 2009-04-16 20:53 -------- d-----w c:\program files\GIMP-2.0 2009-04-16 19:26 . 2009-04-21 16:47 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\AIMP 2009-04-16 19:26 . 2009-04-16 19:26 -------- d-----w c:\program files\AIMP2 2009-04-16 14:21 . 2009-04-16 14:21 -------- d-----w c:\program files\Vimicro 2009-04-16 12:35 . 2009-03-06 14:01 285696 -c----w c:\windows\system32\dllcache\pdh.dll 2009-04-16 12:35 . 2009-02-09 10:03 401408 -c----w c:\windows\system32\dllcache\rpcss.dll 2009-04-16 12:35 . 2009-02-06 09:41 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe 2009-04-16 12:35 . 2005-07-26 04:36 60416 -c----w c:\windows\system32\dllcache\colbact.dll 2009-04-16 12:35 . 2009-02-09 10:03 723456 -c----w c:\windows\system32\dllcache\ntdll.dll 2009-04-16 12:35 . 2009-02-09 10:03 687104 -c----w c:\windows\system32\dllcache\advapi32.dll 2009-04-16 12:35 . 2009-02-09 10:03 473088 -c----w c:\windows\system32\dllcache\fastprox.dll 2009-04-16 12:35 . 2009-02-09 09:55 111104 -c----w c:\windows\system32\dllcache\services.exe 2009-04-16 12:35 . 2009-02-06 09:54 35328 -c----w c:\windows\system32\dllcache\sc.exe 2009-04-16 12:34 . 2009-03-27 07:14 1193414 -c----w c:\windows\system32\dllcache\sysmain.sdb 2009-04-16 12:34 . 2008-04-21 21:28 218112 -c----w c:\windows\system32\dllcache\wordpad.exe 2009-04-14 09:34 . 2007-11-22 21:16 25600 ----a-w c:\windows\system32\borlndmm.dll 2009-04-14 09:34 . 2009-04-14 09:34 -------- d-----w c:\program files\Gizmoz Talking Headz 2009-04-13 21:23 . 2009-04-19 16:43 -------- d-----w c:\program files\SubEdit-Player 2009-04-12 20:19 . 2009-04-12 20:19 -------- d-----w c:\program files\Common Files\Blizzard Entertainment 2009-04-12 19:55 . 2009-04-13 14:05 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\DivX 2009-04-12 19:54 . 2009-02-24 19:35 120056 ------w c:\windows\system32\pxcpyi64.exe 2009-04-12 19:54 . 2009-02-24 19:35 118520 ------w c:\windows\system32\pxinsi64.exe 2009-04-12 19:54 . 2009-04-14 23:29 -------- d-----w c:\program files\DivX 2009-04-12 15:23 . 2009-04-01 21:14 2804893 ----a-w c:\windows\system32\GameMon.des 2009-04-12 15:22 . 2005-01-04 18:43 4682 ----a-w c:\windows\system32\npptNT2.sys 2009-04-12 15:22 . 2003-07-21 03:17 5174 ----a-w c:\windows\system32\nppt9x.vxd 2009-04-12 15:22 . 2009-04-12 15:22 -------- d-----w c:\program files\Common Files\INCA Shared 2009-04-11 19:13 . 2009-04-11 20:30 -------- d-----w c:\windows\system32\CatRoot_bak 2009-04-11 08:44 . 2007-03-10 01:35 100352 -c----w c:\windows\system32\dllcache\6to4svc.dll 2009-04-11 08:40 . 2008-10-03 10:17 247326 -c----w c:\windows\system32\dllcache\strmdll.dll 2009-04-10 22:36 . 2008-06-14 18:01 273024 -c----w c:\windows\system32\dllcache\bthport.sys 2009-04-10 22:36 . 2008-06-14 18:01 273024 ------w c:\windows\system32\drivers\bthport.sys 2009-04-10 22:36 . 2008-08-14 09:48 138368 -c----w c:\windows\system32\dllcache\afd.sys 2009-04-10 22:36 . 2007-07-09 13:20 582656 -c----w c:\windows\system32\dllcache\rpcrt4.dll 2009-04-10 22:33 . 2009-02-09 11:45 2187392 -c----w c:\windows\system32\dllcache\ntoskrnl.exe 2009-04-10 22:33 . 2009-02-09 11:45 2144256 -c----w c:\windows\system32\dllcache\ntkrnlmp.exe 2009-04-10 22:33 . 2009-02-09 11:45 2022400 -c----w c:\windows\system32\dllcache\ntkrpamp.exe 2009-04-10 22:33 . 2009-02-09 11:45 2064256 -c----w c:\windows\system32\dllcache\ntkrnlpa.exe 2009-04-10 22:25 . 2008-05-08 12:14 203008 -c----w c:\windows\system32\dllcache\rmcast.sys 2009-04-10 22:24 . 2008-10-24 11:25 455936 -c----w c:\windows\system32\dllcache\mrxsmb.sys 2009-04-10 22:23 . 2008-06-10 05:07 2376760 -c----w c:\windows\system32\dllcache\WMVCore.dll 2009-04-10 22:22 . 2008-12-11 10:24 333184 -c----w c:\windows\system32\dllcache\srv.sys 2009-04-10 22:22 . 2008-05-01 14:33 331776 -c----w c:\windows\system32\dllcache\msadce.dll 2009-04-10 22:14 . 2008-04-11 18:41 683520 -c----w c:\windows\system32\dllcache\inetcomm.dll 2009-04-10 22:08 . 2008-09-04 16:46 1106944 -c----w c:\windows\system32\dllcache\msxml3.dll 2009-04-10 22:07 . 2008-10-15 16:55 339456 -c----w c:\windows\system32\dllcache\netapi32.dll 2009-04-10 21:20 . 2009-04-10 22:25 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Symantec 2009-04-10 21:19 . 2009-04-10 22:29 -------- d-----w c:\program files\Common Files\Symantec Shared 2009-04-10 21:18 . 2009-04-10 21:18 249856 ------w c:\windows\Setup1.exe 2009-04-10 21:17 . 2009-04-10 21:17 73216 ----a-w c:\windows\ST6UNST.EXE 2009-04-10 21:16 . 2009-04-10 21:26 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\Symantec 2009-04-09 14:38 . 2009-04-09 14:38 -------- d-----w c:\program files\Tibia 2009-04-09 13:41 . 2009-04-09 13:41 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\AdobeUM 2009-04-09 13:41 . 2009-04-09 13:41 -------- d-----w c:\documents and settings\Daniel\Ustawienia lokalne\Dane aplikacji\Adobe 2009-04-09 13:40 . 2009-04-09 13:40 -------- d-----w c:\program files\Common Files\Adobe 2009-04-09 07:46 . 2005-05-26 13:34 2297552 ----a-w c:\windows\system32\d3dx9_26.dll 2009-04-07 14:22 . 2009-04-17 19:46 -------- d-----w c:\program files\HyCam2 2009-04-06 18:27 . 2009-04-20 21:24 69 ----a-w c:\windows\NeroDigital.ini 2009-04-06 17:47 . 2009-04-06 17:47 -------- d--h--w c:\windows\system32\GroupPolicy 2009-04-06 16:30 . 2009-04-06 16:30 -------- d-----w c:\documents and settings\Daniel\Ustawienia lokalne\Dane aplikacji\Help 2009-04-06 15:18 . 2009-04-06 15:18 -------- d-----w c:\windows\Cache 2009-04-06 12:55 . 2009-04-06 12:56 -------- d-----w c:\program files\DAEMON Tools Lite 2009-04-05 21:56 . 2008-03-05 13:56 3786760 ----a-w c:\windows\system32\D3DX9_37.dll 2009-04-05 20:48 . 2009-04-05 20:48 4 ----a-w c:\windows\system32\proc-220146841.bin 2009-04-05 16:12 . 2009-04-05 16:12 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\Media Player Classic 2009-04-04 18:42 . 2009-04-21 18:09 -------- d-----w c:\program files\AutoConnect 2009-04-04 18:07 . 2009-04-12 18:18 -------- d-----w c:\program files\Gadu-Gadu 2009-04-04 15:19 . 2009-04-08 23:41 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\GanymedeNet 2009-04-04 15:18 . 2009-04-14 22:30 -------- d-----w c:\program files\Ganymede 2009-04-03 20:58 . 2009-04-03 20:58 -------- d-----w c:\documents and settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Apple 2009-04-03 20:55 . 2009-04-03 20:55 56 ---ha-w c:\windows\system32\ezsidmv.dat 2009-04-03 20:55 . 2009-04-21 17:31 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\skypePM 2009-04-03 20:54 . 2009-04-21 18:10 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\Skype 2009-04-03 20:53 . 2009-04-03 20:53 -------- d-----w c:\program files\Common Files\Skype 2009-04-03 20:53 . 2009-04-03 20:54 -------- d-----r c:\program files\Skype 2009-04-03 20:53 . 2009-04-03 20:53 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Skype 2009-04-02 15:35 . 2009-04-02 15:35 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\Apple Computer 2009-04-02 01:04 . 2009-04-02 01:04 -------- d-----w c:\documents and settings\Daniel\Ustawienia lokalne\Dane aplikacji\Apple 2009-04-02 01:04 . 2009-04-02 01:04 -------- d-----w c:\documents and settings\Daniel\Ustawienia lokalne\Dane aplikacji\Apple Computer 2009-03-30 17:46 . 2009-03-30 17:47 32785 ----a-w c:\windows\diagerr.xml 2009-03-30 17:46 . 2009-03-30 17:47 2153 ----a-w c:\windows\diagwrn.xml 2009-03-29 11:45 . 2009-03-29 11:45 488 ---ha-r c:\windows\system32\logonui.exe.manifest 2009-03-29 11:45 . 2009-03-29 11:45 749 ---ha-r c:\windows\WindowsShell.Manifest 2009-03-29 11:45 . 2009-03-29 11:45 749 ---ha-r c:\windows\system32\wuaucpl.cpl.manifest 2009-03-29 11:45 . 2009-03-29 11:45 749 ---ha-r c:\windows\system32\sapi.cpl.manifest 2009-03-29 11:45 . 2009-03-29 11:45 749 ---ha-r c:\windows\system32\nwc.cpl.manifest 2009-03-29 11:45 . 2009-03-29 11:45 749 ---ha-r c:\windows\system32\ncpa.cpl.manifest 2009-03-29 11:38 . 2006-09-13 16:18 20992 ----a-w c:\windows\system32\drivers\RTL8139.sys 2009-03-29 11:35 . 2001-10-26 18:29 24661 ----a-w c:\windows\system32\spxcoins.dll 2009-03-29 11:35 . 2001-10-26 18:29 13312 ----a-w c:\windows\system32\irclass.dll 2009-03-29 11:34 . 2004-08-04 00:26 14043 ----a-r c:\windows\SETB7.tmp 2009-03-29 11:34 . 2004-08-04 00:27 1086058 ----a-r c:\windows\SETAB.tmp 2009-03-29 11:34 . 2004-08-04 00:32 1014483 ----a-r c:\windows\SETA8.tmp 2009-03-29 11:10 . 2009-03-29 11:10 64512 ----a-w c:\windows\system32\ewf3.pxf 2009-03-29 11:10 . 2009-03-29 11:10 32768 ----a-w c:\windows\system32\fe3.wa 2009-03-29 11:10 . 2009-03-29 11:10 245 ----a-w c:\windows\tmp6764828.bat . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-21 07:20 . 2009-03-27 17:37 -------- d--h--w c:\program files\InstallShield Installation Information 2009-04-20 15:59 . 2007-03-10 01:31 219648 ----a-w c:\windows\system32\uxtheme.dll 2009-04-17 12:11 . 2001-10-26 17:15 75486 ----a-w c:\windows\system32\perfc015.dat 2009-04-17 12:11 . 2001-10-26 17:15 352982 ----a-w c:\windows\system32\perfh015.dat 2009-04-16 18:36 . 2009-03-27 17:49 -------- d-----w c:\program files\Common Files\InstallShield 2009-04-07 16:59 . 2009-03-27 17:50 -------- d-----w c:\program files\Kaspersky Lab 2009-04-06 18:32 . 2009-03-27 17:12 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat 2009-04-06 17:25 . 2009-03-27 17:50 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2009-04-06 05:34 . 2009-03-27 17:48 717296 ----a-w c:\windows\system32\drivers\sptd.sys 2009-03-29 11:42 . 2009-03-27 17:10 23016 ----a-w c:\windows\system32\emptyregdb.dat 2009-03-29 11:11 . 2009-03-27 17:58 98304 ----a-w c:\windows\DUMP412f.tmp 2009-03-28 00:37 . 2009-03-27 18:47 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\Winamp 2009-03-27 18:53 . 2009-03-27 18:47 -------- d-----w c:\program files\Winamp 2009-03-27 17:41 . 2009-03-27 17:41 33 ----a-w c:\windows\system32\drivers\adidsl.cfg 2009-03-27 17:40 . 2009-03-27 17:40 -------- d-----w c:\program files\SAGEM 2009-03-27 17:40 . 2009-03-27 17:40 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\InstallShield 2009-03-27 17:11 . 2009-03-27 17:11 -------- d-----w c:\program files\Usługi online 2009-03-06 14:01 . 2004-08-03 23:44 285696 ----a-w c:\windows\system32\pdh.dll 2009-02-24 19:35 . 2009-03-27 18:47 129784 ------w c:\windows\system32\pxafs.dll 2009-02-20 08:16 . 2007-01-04 13:05 670720 ----a-w c:\windows\system32\wininet.dll 2009-02-20 08:16 . 2004-08-03 23:44 81920 ----a-w c:\windows\system32\ieencode.dll 2009-02-09 13:56 . 2007-03-10 01:32 1847680 ----a-w c:\windows\system32\win32k.sys 2009-02-09 11:45 . 2006-10-30 06:03 2064256 ----a-w c:\windows\system32\ntkrnlpa.exe 2009-02-09 11:45 . 2007-03-10 01:32 2187392 ----a-w c:\windows\system32\ntoskrnl.exe 2009-02-09 10:03 . 2007-03-10 01:35 730624 ----a-w c:\windows\system32\lsasrv.dll 2009-02-09 10:03 . 2006-09-13 15:30 401408 ----a-w c:\windows\system32\rpcss.dll 2009-02-09 10:03 . 2004-08-03 23:43 687104 ----a-w c:\windows\system32\advapi32.dll 2009-02-09 10:03 . 2004-08-03 23:43 723456 ----a-w c:\windows\system32\ntdll.dll 2009-02-09 09:55 . 2004-08-03 23:44 111104 ----a-w c:\windows\system32\services.exe 2009-02-06 09:54 . 2001-10-26 18:30 35328 ----a-w c:\windows\system32\sc.exe 2009-02-03 19:53 . 2004-08-03 23:44 56320 ----a-w c:\windows\system32\secur32.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-03-27 24103720] "AutoConnect"="c:\program files\AutoConnect\AutoConnect.exe" [2004-08-28 295424] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-04-17 2113536] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016] "BigDog305"="c:\windows\VM305_STI.EXE" [2007-04-09 57344] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-19 148888] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-10-22 1622016] "SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2005-11-11 90112] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\Daniel\Menu Start\Programy\Autostart\ Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2009-3-27 1205840] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Documents and Settings\\Daniel\\Pulpit\\utorrent.exe"= "c:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"= "c:\\WINDOWS\\system32\\java.exe"= "e:\\NFSMW\\speed.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\program files\\relevantknowledge\\rlvknlg.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R2 E4LOADER;General Purpose USB Driver (e4ldr.sys);c:\windows\system32\Drivers\e4ldr.sys [2007-01-04 69656] R3 AVPsys;AVPsys; [x] R3 dump_wmimmc;dump_wmimmc; [x] R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2009-04-01 2804893] R3 NTProcDrv;Process creation detector for NT.; [x] S1 aswSP;avast! Self Protection; [x] S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560] S3 e4usbaw;USB ADSL2 WAN Adapter;c:\windows\system32\DRIVERS\e4usbaw.sys [2007-01-04 104344] S3 ZSMC0305;A4 TECH PC Camera V;c:\windows\system32\Drivers\usbVM305.sys [2006-05-08 391688] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{239c11a0-2129-11de-8f5a-4d6564696130}] \Shell\AutoRun\command - luk1ylq.com \Shell\open\Command - luk1ylq.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{66e7c1f0-22ce-11de-8f6c-4d6564696130}] \Shell\AutoRun\command - H:\ej10fkdo.bat \Shell\open\Command - H:\ej10fkdo.bat . - - - - USUNIĘTO PUSTE WPISY - - - - HKCU-Run-cdoosoft - c:\windows\system32\olhrwef.exe HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe . ------- Skan uzupełniający ------- . IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000 TCP: {874AB105-4D52-4A41-8B7B-EF3F7E13DF65} = 213.241.79.37 83.238.255.76 FF - ProfilePath - c:\documents and settings\Daniel\Dane aplikacji\Mozilla\Firefox\Profiles\426jjagt.default\ FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npganymedenet.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPSOCCER.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-21 20:10 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run BigDog305 = c:\windows\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)???????????????????0?????????@?????????????? skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-343818398-2077806209-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'explorer.exe'(2852) c:\windows\system32\browselc.dll c:\program files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll c:\program files\Microsoft Office\Office12\1045\GrooveIntlResource.dll c:\windows\system32\wmvcore.dll c:\windows\system32\WMASF.DLL . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\windows\system32\rundll32.exe c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\nvsvc32.exe . ************************************************************************** . Czas ukończenia: 2009-04-21 20:13 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-04-21 18:13 Przed: 6 690 131 968 bajtów wolnych Po: 6 663 647 232 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 321 --- E O F --- 2009-04-17 05:36

Proszę POMÓŻCIE !!

**Posty:** 18165 · przez **wojtas** 21 Kwi 2009, 19:44

daj loga z combofixa (przyklejony temat) w tagach code a nie quote... i log z hijacka tez zmien na code

**Posty:** 8 · przez **LikeThis** 22 Kwi 2009, 20:14

Pomozcie !!

**Posty:** 18165 · przez **wojtas** 22 Kwi 2009, 20:17

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{239c11a0-2129-11de-8f5a-4d6564696130}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{66e7c1f0-22ce-11de-8f6c-4d6564696130}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

**Posty:** 8 · przez **LikeThis** 24 Kwi 2009, 16:43

Log z FixIEDef :

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.22.7514 * * * ******************************************************************************** Created at 16:24:20 on Friday, April 24, 2009 Time Zone : Logged On User : Daniel Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2 OS Architecture : X86 System Langauge : Polish Keyboard Layout : Polish Processor : X64 Intel(R) Celeron(R) CPU 3.20GHz System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 25 GB System Drive Free : 6.88 GB Total Physical Memory: 510 MB Free Physical Memory : 209 MB Total Page File : 510 MB Free Page File : 757 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1956 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

A kasperskym sie niedalo przeskanowac
Przeskanowalem kompa takze Dr. Web CureIt i tez nic nieznalazl wiec nie wiem juz
Gdy mialem wlaczonego Avasta pojawil sie komunikat ze wykryto Win32:Rootkit-gen [Rtk] !!
Juz nie wiem co robic !...

**Posty:** 18165 · przez **wojtas** 24 Kwi 2009, 19:36

w jakim pliku ?? daj nowego loga z combofixa

**Posty:** 8 · przez **LikeThis** 25 Kwi 2009, 04:26

Kod: Zaznacz wszystko: ComboFix 09-04-25.03 - Daniel 2009-04-25 4:19.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.510.162 [GMT 2:00] Uruchomiony z: c:\documents and settings\Daniel\Pulpit\ComboFix.exe AV: avast! antivirus 4.8.1335 [VPS 090425-0] *On-access scanning disabled* (Updated) * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((( Pliki utworzone od 2009-05-25 do 2009-4-25 ))))))))))))))))))))))))))))))) . 2009-04-24 14:21 . 2009-04-24 14:21 -------- d-----w C:\ERDNT 2009-04-24 14:21 . 2009-04-24 14:21 -------- d-----w c:\windows\ERUNT 2009-04-24 14:21 . 2009-04-24 14:21 -------- d-----w C:\!FixIEDef 2009-04-23 10:29 . 2009-04-23 10:29 -------- d-----w c:\documents and settings\Daniel\DoctorWeb 2009-04-22 21:21 . 2009-04-23 10:31 -------- d-----w c:\program files\Odkurzacz 2009-04-22 18:37 . 2006-09-13 16:19 15104 -c--a-w c:\windows\system32\dllcache\usbscan.sys 2009-04-22 18:37 . 2006-09-13 16:19 15104 ----a-w c:\windows\system32\drivers\usbscan.sys 2009-04-22 18:37 . 2006-09-13 16:17 5632 ----a-w c:\windows\system32\ptpusb.dll 2009-04-22 18:37 . 2006-09-13 16:19 159232 ----a-w c:\windows\system32\ptpusd.dll 2009-04-22 17:11 . 2009-04-22 17:11 -------- d-----w c:\documents and settings\Daniel\.thumbnails 2009-04-22 17:09 . 2009-04-23 14:44 55037 ----a-w c:\windows\War3Unin.dat 2009-04-22 17:09 . 2009-04-23 14:44 2829 ----a-w c:\windows\War3Unin.pif 2009-04-22 17:09 . 2009-04-23 14:44 139264 ----a-w c:\windows\War3Unin.exe 2009-04-21 19:46 . 2009-04-21 19:46 -------- d-----w c:\documents and settings\Daniel\Ustawienia lokalne\Dane aplikacji\Opera 2009-04-21 19:45 . 2009-04-22 17:15 -------- d-----w c:\program files\Opera 2009-04-21 19:01 . 2009-04-21 19:02 -------- d-----w c:\program files\USB Disk Win98 Driver 2009-04-21 18:09 . 2009-04-21 18:09 -------- d-----w c:\windows\system32\xircom 2009-04-21 18:09 . 2009-04-21 18:09 -------- d-----w c:\program files\microsoft frontpage 2009-04-21 17:42 . 2009-04-21 17:42 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\vlc 2009-04-20 21:03 . 2009-04-20 21:03 -------- d-----w c:\program files\Damian Pasternak 2009-04-20 19:59 . 2009-04-20 20:00 460173 ----a-w C:\R0420__21_59_52.mp3 2009-04-20 19:46 . 2009-04-20 21:10 -------- d-----w c:\program files\RelevantKnowledge 2009-04-20 16:01 . 2009-04-20 16:01 -------- d-----w c:\documents and settings\Daniel\Ustawienia lokalne\Dane aplikacji\Stardock 2009-04-20 15:59 . 2009-04-20 15:59 36913 ----a-w c:\windows\BricoPackUninst.cmd 2009-04-20 15:57 . 2009-04-20 15:57 3932214 ----a-w c:\windows\BricoPack Wallpaper.bmp 2009-04-20 15:54 . 2009-04-20 15:59 2155 ----a-w c:\windows\BricoPackFoldersDelete.cmd 2009-04-20 15:53 . 2009-04-20 15:53 -------- d-----w c:\windows\BricoPacks 2009-04-19 23:58 . 2009-04-19 23:58 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\OpenFM 2009-04-19 23:14 . 2009-04-20 20:29 -------- d-----w c:\windows\Icons 2009-04-19 22:50 . 2009-04-20 17:00 -------- d-----w c:\program files\Mozilla Firefox 3.1 Beta 3 2009-04-19 21:57 . 2009-04-19 21:57 -------- d-----w c:\program files\VideoLAN 2009-04-19 19:28 . 2009-04-19 19:28 -------- d-----w c:\program files\Trend Micro 2009-04-19 19:12 . 2009-04-20 16:29 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\Nowe Gadu-Gadu 2009-04-19 15:26 . 2009-04-19 15:26 73728 ----a-w c:\windows\system32\javacpl.cpl 2009-04-18 20:27 . 2009-04-19 21:50 -------- d-----w C:\TEMP 2009-04-18 20:04 . 2003-03-18 19:20 1060864 ----a-w c:\windows\system32\MFC71.dll 2009-04-18 20:04 . 2003-03-18 18:14 499712 ----a-w c:\windows\system32\MSVCP71.dll 2009-04-18 20:04 . 2009-04-18 20:04 -------- d-----w c:\program files\Alwil Software 2009-04-18 19:46 . 2002-01-05 13:37 344064 ----a-w c:\windows\system32\msvcr70.dll 2009-04-18 19:34 . 2009-04-18 20:30 -------- d-----w c:\program files\Total Video Converter 2009-04-18 13:07 . 2009-04-18 13:07 -------- d-----w c:\documents and settings\Daniel\Ustawienia lokalne\Dane aplikacji\vdownloader 2009-04-18 13:07 . 2009-04-18 13:59 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\Desktopicon 2009-04-16 20:54 . 2009-04-23 14:39 -------- d-----w c:\documents and settings\Daniel\.gimp-2.6 2009-04-16 20:54 . 2009-04-16 20:54 -------- d-----w c:\documents and settings\Daniel\.gegl-0.0 2009-04-16 20:53 . 2009-04-16 20:53 -------- d-----w c:\program files\GIMP-2.0 2009-04-16 19:26 . 2009-04-24 18:45 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\AIMP 2009-04-16 19:26 . 2009-04-16 19:26 -------- d-----w c:\program files\AIMP2 2009-04-16 14:21 . 2009-04-16 14:21 -------- d-----w c:\program files\Vimicro 2009-04-16 12:35 . 2009-03-06 14:01 285696 -c----w c:\windows\system32\dllcache\pdh.dll 2009-04-16 12:35 . 2009-02-09 10:03 401408 -c----w c:\windows\system32\dllcache\rpcss.dll 2009-04-16 12:35 . 2009-02-06 09:41 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe 2009-04-16 12:35 . 2005-07-26 04:36 60416 -c----w c:\windows\system32\dllcache\colbact.dll 2009-04-16 12:35 . 2009-02-09 10:03 723456 -c----w c:\windows\system32\dllcache\ntdll.dll 2009-04-16 12:35 . 2009-02-09 10:03 687104 -c----w c:\windows\system32\dllcache\advapi32.dll 2009-04-16 12:35 . 2009-02-09 10:03 473088 -c----w c:\windows\system32\dllcache\fastprox.dll 2009-04-16 12:35 . 2009-02-09 09:55 111104 -c----w c:\windows\system32\dllcache\services.exe 2009-04-16 12:35 . 2009-02-06 09:54 35328 -c----w c:\windows\system32\dllcache\sc.exe 2009-04-16 12:34 . 2009-03-27 07:14 1193414 -c----w c:\windows\system32\dllcache\sysmain.sdb 2009-04-16 12:34 . 2008-04-21 21:28 218112 -c----w c:\windows\system32\dllcache\wordpad.exe 2009-04-14 09:34 . 2007-11-22 21:16 25600 ----a-w c:\windows\system32\borlndmm.dll 2009-04-14 09:34 . 2009-04-14 09:34 -------- d-----w c:\program files\Gizmoz Talking Headz 2009-04-13 21:23 . 2009-04-19 16:43 -------- d-----w c:\program files\SubEdit-Player 2009-04-12 20:19 . 2009-04-12 20:19 -------- d-----w c:\program files\Common Files\Blizzard Entertainment 2009-04-12 19:55 . 2009-04-13 14:05 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\DivX 2009-04-12 19:54 . 2009-02-24 19:35 120056 ------w c:\windows\system32\pxcpyi64.exe 2009-04-12 19:54 . 2009-02-24 19:35 118520 ------w c:\windows\system32\pxinsi64.exe 2009-04-12 19:54 . 2009-04-14 23:29 -------- d-----w c:\program files\DivX 2009-04-12 15:23 . 2009-04-01 21:14 2804893 ----a-w c:\windows\system32\GameMon.des 2009-04-12 15:22 . 2005-01-04 18:43 4682 ----a-w c:\windows\system32\npptNT2.sys 2009-04-12 15:22 . 2003-07-21 03:17 5174 ----a-w c:\windows\system32\nppt9x.vxd 2009-04-12 15:22 . 2009-04-12 15:22 -------- d-----w c:\program files\Common Files\INCA Shared 2009-04-11 19:13 . 2009-04-11 20:30 -------- d-----w c:\windows\system32\CatRoot_bak 2009-04-11 08:44 . 2007-03-10 01:35 100352 -c----w c:\windows\system32\dllcache\6to4svc.dll 2009-04-11 08:40 . 2008-10-03 10:17 247326 -c----w c:\windows\system32\dllcache\strmdll.dll 2009-04-10 22:36 . 2008-06-14 18:01 273024 -c----w c:\windows\system32\dllcache\bthport.sys 2009-04-10 22:36 . 2008-06-14 18:01 273024 ------w c:\windows\system32\drivers\bthport.sys 2009-04-10 22:36 . 2008-08-14 09:48 138368 -c----w c:\windows\system32\dllcache\afd.sys 2009-04-10 22:36 . 2007-07-09 13:20 582656 -c----w c:\windows\system32\dllcache\rpcrt4.dll 2009-04-10 22:33 . 2009-02-09 11:45 2187392 -c----w c:\windows\system32\dllcache\ntoskrnl.exe 2009-04-10 22:33 . 2009-02-09 11:45 2144256 -c----w c:\windows\system32\dllcache\ntkrnlmp.exe 2009-04-10 22:33 . 2009-02-09 11:45 2022400 -c----w c:\windows\system32\dllcache\ntkrpamp.exe 2009-04-10 22:33 . 2009-02-09 11:45 2064256 -c----w c:\windows\system32\dllcache\ntkrnlpa.exe 2009-04-10 22:25 . 2008-05-08 12:14 203008 -c----w c:\windows\system32\dllcache\rmcast.sys 2009-04-10 22:24 . 2008-10-24 11:25 455936 -c----w c:\windows\system32\dllcache\mrxsmb.sys 2009-04-10 22:23 . 2008-06-10 05:07 2376760 -c----w c:\windows\system32\dllcache\WMVCore.dll 2009-04-10 22:22 . 2008-12-11 10:24 333184 -c----w c:\windows\system32\dllcache\srv.sys 2009-04-10 22:22 . 2008-05-01 14:33 331776 -c----w c:\windows\system32\dllcache\msadce.dll 2009-04-10 22:14 . 2008-04-11 18:41 683520 -c----w c:\windows\system32\dllcache\inetcomm.dll 2009-04-10 22:08 . 2008-09-04 16:46 1106944 -c----w c:\windows\system32\dllcache\msxml3.dll 2009-04-10 22:07 . 2008-10-15 16:55 339456 -c----w c:\windows\system32\dllcache\netapi32.dll 2009-04-10 21:20 . 2009-04-10 22:25 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Symantec 2009-04-10 21:19 . 2009-04-10 22:29 -------- d-----w c:\program files\Common Files\Symantec Shared 2009-04-10 21:18 . 2009-04-10 21:18 249856 ------w c:\windows\Setup1.exe 2009-04-10 21:17 . 2009-04-10 21:17 73216 ----a-w c:\windows\ST6UNST.EXE 2009-04-10 21:16 . 2009-04-10 21:26 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\Symantec 2009-04-09 14:38 . 2009-04-09 14:38 -------- d-----w c:\program files\Tibia 2009-04-09 13:41 . 2009-04-09 13:41 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\AdobeUM 2009-04-09 13:41 . 2009-04-09 13:41 -------- d-----w c:\documents and settings\Daniel\Ustawienia lokalne\Dane aplikacji\Adobe 2009-04-09 13:40 . 2009-04-09 13:40 -------- d-----w c:\program files\Common Files\Adobe 2009-04-09 07:46 . 2005-05-26 13:34 2297552 ----a-w c:\windows\system32\d3dx9_26.dll 2009-04-07 14:22 . 2009-04-17 19:46 -------- d-----w c:\program files\HyCam2 2009-04-06 18:27 . 2009-04-23 14:24 69 ----a-w c:\windows\NeroDigital.ini 2009-04-06 17:47 . 2009-04-06 17:47 -------- d--h--w c:\windows\system32\GroupPolicy 2009-04-06 16:30 . 2009-04-06 16:30 -------- d-----w c:\documents and settings\Daniel\Ustawienia lokalne\Dane aplikacji\Help 2009-04-06 15:18 . 2009-04-06 15:18 -------- d-----w c:\windows\Cache 2009-04-06 12:55 . 2009-04-06 12:56 -------- d-----w c:\program files\DAEMON Tools Lite 2009-04-05 21:56 . 2008-03-05 13:56 3786760 ----a-w c:\windows\system32\D3DX9_37.dll 2009-04-05 20:48 . 2009-04-05 20:48 4 ----a-w c:\windows\system32\proc-220146841.bin 2009-04-05 16:12 . 2009-04-05 16:12 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\Media Player Classic 2009-04-04 18:42 . 2009-04-24 17:27 -------- d-----w c:\program files\AutoConnect 2009-04-04 18:07 . 2009-04-12 18:18 -------- d-----w c:\program files\Gadu-Gadu 2009-04-04 15:19 . 2009-04-08 23:41 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\GanymedeNet 2009-04-04 15:18 . 2009-04-14 22:30 -------- d-----w c:\program files\Ganymede 2009-04-03 20:58 . 2009-04-03 20:58 -------- d-----w c:\documents and settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Apple 2009-04-03 20:55 . 2009-04-03 20:55 56 ---ha-w c:\windows\system32\ezsidmv.dat 2009-04-03 20:55 . 2009-04-24 22:08 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\skypePM 2009-04-03 20:54 . 2009-04-25 01:30 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\Skype 2009-04-03 20:53 . 2009-04-03 20:53 -------- d-----w c:\program files\Common Files\Skype 2009-04-03 20:53 . 2009-04-03 20:54 -------- d-----r c:\program files\Skype 2009-04-03 20:53 . 2009-04-03 20:53 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Skype 2009-04-02 15:35 . 2009-04-02 15:35 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\Apple Computer 2009-04-02 01:04 . 2009-04-02 01:04 -------- d-----w c:\documents and settings\Daniel\Ustawienia lokalne\Dane aplikacji\Apple 2009-04-02 01:04 . 2009-04-02 01:04 -------- d-----w c:\documents and settings\Daniel\Ustawienia lokalne\Dane aplikacji\Apple Computer 2009-03-30 17:46 . 2009-03-30 17:47 32785 ----a-w c:\windows\diagerr.xml 2009-03-30 17:46 . 2009-03-30 17:47 2153 ----a-w c:\windows\diagwrn.xml . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-21 19:01 . 2009-03-27 17:37 -------- d--h--w c:\program files\InstallShield Installation Information 2009-04-21 18:58 . 2009-03-27 17:49 -------- d-----w c:\program files\Common Files\InstallShield 2009-04-20 15:59 . 2007-03-10 01:31 219648 ----a-w c:\windows\system32\uxtheme.dll 2009-04-17 12:11 . 2001-10-26 17:15 75486 ----a-w c:\windows\system32\perfc015.dat 2009-04-17 12:11 . 2001-10-26 17:15 352982 ----a-w c:\windows\system32\perfh015.dat 2009-04-07 16:59 . 2009-03-27 17:50 -------- d-----w c:\program files\Kaspersky Lab 2009-04-06 18:32 . 2009-03-27 17:12 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat 2009-04-06 17:25 . 2009-03-27 17:50 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2009-04-06 05:34 . 2009-03-27 17:48 717296 ----a-w c:\windows\system32\drivers\sptd.sys 2009-03-29 11:42 . 2009-03-27 17:10 23016 ----a-w c:\windows\system32\emptyregdb.dat 2009-03-29 11:11 . 2009-03-27 17:58 98304 ----a-w c:\windows\DUMP412f.tmp 2009-03-28 00:37 . 2009-03-27 18:47 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\Winamp 2009-03-27 18:53 . 2009-03-27 18:47 -------- d-----w c:\program files\Winamp 2009-03-27 17:41 . 2009-03-27 17:41 33 ----a-w c:\windows\system32\drivers\adidsl.cfg 2009-03-27 17:40 . 2009-03-27 17:40 -------- d-----w c:\program files\SAGEM 2009-03-27 17:40 . 2009-03-27 17:40 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\InstallShield 2009-03-27 17:11 . 2009-03-27 17:11 -------- d-----w c:\program files\Usługi online 2009-03-06 14:01 . 2004-08-03 23:44 285696 ----a-w c:\windows\system32\pdh.dll 2009-02-24 19:35 . 2009-03-27 18:47 129784 ------w c:\windows\system32\pxafs.dll 2009-02-20 08:16 . 2007-01-04 13:05 670720 ----a-w c:\windows\system32\wininet.dll 2009-02-20 08:16 . 2004-08-03 23:44 81920 ----a-w c:\windows\system32\ieencode.dll 2009-02-09 13:56 . 2007-03-10 01:32 1847680 ----a-w c:\windows\system32\win32k.sys 2009-02-09 11:45 . 2006-10-30 06:03 2064256 ----a-w c:\windows\system32\ntkrnlpa.exe 2009-02-09 11:45 . 2007-03-10 01:32 2187392 ----a-w c:\windows\system32\ntoskrnl.exe 2009-02-09 10:03 . 2007-03-10 01:35 730624 ----a-w c:\windows\system32\lsasrv.dll 2009-02-09 10:03 . 2006-09-13 15:30 401408 ----a-w c:\windows\system32\rpcss.dll 2009-02-09 10:03 . 2004-08-03 23:43 687104 ----a-w c:\windows\system32\advapi32.dll 2009-02-09 10:03 . 2004-08-03 23:43 723456 ----a-w c:\windows\system32\ntdll.dll 2009-02-09 09:55 . 2004-08-03 23:44 111104 ----a-w c:\windows\system32\services.exe 2009-02-06 09:54 . 2001-10-26 18:30 35328 ----a-w c:\windows\system32\sc.exe 2009-02-03 19:53 . 2004-08-03 23:44 56320 ----a-w c:\windows\system32\secur32.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-03-27 24103720] "AutoConnect"="c:\program files\AutoConnect\AutoConnect.exe" [2004-08-28 295424] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-04-17 2113536] "Odkurzacz-MCD"="c:\program files\Odkurzacz\odk_mcd.exe" [2008-08-16 264704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016] "BigDog305"="c:\windows\VM305_STI.EXE" [2007-04-09 57344] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-19 148888] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000] "USB Storage Toolbox"="c:\program files\USB Disk Win98 Driver\Res.EXE" [2005-09-14 65536] "SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2005-11-11 90112] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\Daniel\Menu Start\Programy\Autostart\ Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2009-3-27 1205840] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Documents and Settings\\Daniel\\Pulpit\\utorrent.exe"= "c:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"= "c:\\WINDOWS\\system32\\java.exe"= "e:\\NFSMW\\speed.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\program files\\relevantknowledge\\rlvknlg.exe"= "e:\\Program Files\\Warcraft III\\Warcraft III.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R2 E4LOADER;General Purpose USB Driver (e4ldr.sys);c:\windows\system32\Drivers\e4ldr.sys [2007-01-04 69656] R3 AVPsys;AVPsys; [x] R3 dump_wmimmc;dump_wmimmc; [x] R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2009-04-01 2804893] R3 NTProcDrv;Process creation detector for NT.; [x] S1 aswSP;avast! Self Protection; [x] S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560] S3 e4usbaw;USB ADSL2 WAN Adapter;c:\windows\system32\DRIVERS\e4usbaw.sys [2007-01-04 104344] S3 ZSMC0305;A4 TECH PC Camera V;c:\windows\system32\Drivers\usbVM305.sys [2006-05-08 391688] . . ------- Skan uzupełniający ------- . IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000 TCP: {874AB105-4D52-4A41-8B7B-EF3F7E13DF65} = 213.241.79.37 83.238.255.76 FF - ProfilePath - c:\documents and settings\Daniel\Dane aplikacji\Mozilla\Firefox\Profiles\426jjagt.default\ FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npganymedenet.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPSOCCER.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-25 04:22 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run BigDog305 = c:\windows\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)???????????????????0?????????@?????????????? skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-343818398-2077806209-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'explorer.exe'(2912) c:\program files\Gadu-Gadu\ggwhook.dll . Czas ukończenia: 2009-04-25 4:24 ComboFix-quarantined-files.txt 2009-04-25 02:23 ComboFix2.txt 2009-04-24 18:40 Przed: 5 051 654 144 bajtów wolnych Po: 5 042 065 408 bajtów wolnych 268 --- E O F --- 2009-04-17 05:36

Ale nie wiem czy to cos pomoze

**Posty:** 18165 · przez **wojtas** 25 Kwi 2009, 13:45

Otworz notatnik i wklej w nim to:

Folder::
c:\program files\RelevantKnowledge

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 8 · przez **LikeThis** 25 Kwi 2009, 14:13

Kod: Zaznacz wszystko: ComboFix 09-04-25.A1 - Daniel 2009-04-25 14:07.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.510.127 [GMT 2:00] Uruchomiony z: c:\documents and settings\Daniel\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\Daniel\Pulpit\CFScript.txt.txt AV: avast! antivirus 4.8.1335 [VPS 090425-0] *On-access scanning disabled* (Updated) * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\RelevantKnowledge c:\program files\RelevantKnowledge\rlls.dll c:\program files\RelevantKnowledge\rloci.bin c:\program files\RelevantKnowledge\rlservice.exe c:\program files\RelevantKnowledge\rlvknlg.exe . ((((((((((((((((((((((((( Pliki utworzone od 2009-05-25 do 2009-4-25 ))))))))))))))))))))))))))))))) . 2009-04-24 14:21 . 2009-04-24 14:21 -------- d-----w C:\ERDNT 2009-04-24 14:21 . 2009-04-24 14:21 -------- d-----w c:\windows\ERUNT 2009-04-24 14:21 . 2009-04-24 14:21 -------- d-----w C:\!FixIEDef 2009-04-23 10:29 . 2009-04-23 10:29 -------- d-----w c:\documents and settings\Daniel\DoctorWeb 2009-04-22 21:21 . 2009-04-23 10:31 -------- d-----w c:\program files\Odkurzacz 2009-04-22 18:37 . 2006-09-13 16:19 15104 -c--a-w c:\windows\system32\dllcache\usbscan.sys 2009-04-22 18:37 . 2006-09-13 16:19 15104 ----a-w c:\windows\system32\drivers\usbscan.sys 2009-04-22 18:37 . 2006-09-13 16:17 5632 ----a-w c:\windows\system32\ptpusb.dll 2009-04-22 18:37 . 2006-09-13 16:19 159232 ----a-w c:\windows\system32\ptpusd.dll 2009-04-22 17:11 . 2009-04-22 17:11 -------- d-----w c:\documents and settings\Daniel\.thumbnails 2009-04-22 17:09 . 2009-04-23 14:44 55037 ----a-w c:\windows\War3Unin.dat 2009-04-22 17:09 . 2009-04-23 14:44 2829 ----a-w c:\windows\War3Unin.pif 2009-04-22 17:09 . 2009-04-23 14:44 139264 ----a-w c:\windows\War3Unin.exe 2009-04-21 19:46 . 2009-04-21 19:46 -------- d-----w c:\documents and settings\Daniel\Ustawienia lokalne\Dane aplikacji\Opera 2009-04-21 19:45 . 2009-04-22 17:15 -------- d-----w c:\program files\Opera 2009-04-21 19:01 . 2009-04-21 19:02 -------- d-----w c:\program files\USB Disk Win98 Driver 2009-04-21 18:09 . 2009-04-21 18:09 -------- d-----w c:\windows\system32\xircom 2009-04-21 18:09 . 2009-04-21 18:09 -------- d-----w c:\program files\microsoft frontpage 2009-04-21 17:42 . 2009-04-21 17:42 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\vlc 2009-04-20 21:03 . 2009-04-20 21:03 -------- d-----w c:\program files\Damian Pasternak 2009-04-20 19:59 . 2009-04-20 20:00 460173 ----a-w C:\R0420__21_59_52.mp3 2009-04-20 16:01 . 2009-04-20 16:01 -------- d-----w c:\documents and settings\Daniel\Ustawienia lokalne\Dane aplikacji\Stardock 2009-04-20 15:59 . 2009-04-20 15:59 36913 ----a-w c:\windows\BricoPackUninst.cmd 2009-04-20 15:57 . 2009-04-20 15:57 3932214 ----a-w c:\windows\BricoPack Wallpaper.bmp 2009-04-20 15:54 . 2009-04-20 15:59 2155 ----a-w c:\windows\BricoPackFoldersDelete.cmd 2009-04-20 15:53 . 2009-04-20 15:53 -------- d-----w c:\windows\BricoPacks 2009-04-19 23:58 . 2009-04-19 23:58 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\OpenFM 2009-04-19 23:14 . 2009-04-20 20:29 -------- d-----w c:\windows\Icons 2009-04-19 22:50 . 2009-04-20 17:00 -------- d-----w c:\program files\Mozilla Firefox 3.1 Beta 3 2009-04-19 21:57 . 2009-04-19 21:57 -------- d-----w c:\program files\VideoLAN 2009-04-19 19:28 . 2009-04-19 19:28 -------- d-----w c:\program files\Trend Micro 2009-04-19 19:12 . 2009-04-20 16:29 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\Nowe Gadu-Gadu 2009-04-19 15:26 . 2009-04-19 15:26 73728 ----a-w c:\windows\system32\javacpl.cpl 2009-04-18 20:27 . 2009-04-25 11:55 -------- d-----w C:\TEMP 2009-04-18 20:04 . 2003-03-18 19:20 1060864 ----a-w c:\windows\system32\MFC71.dll 2009-04-18 20:04 . 2003-03-18 18:14 499712 ----a-w c:\windows\system32\MSVCP71.dll 2009-04-18 20:04 . 2009-04-18 20:04 -------- d-----w c:\program files\Alwil Software 2009-04-18 19:46 . 2002-01-05 13:37 344064 ----a-w c:\windows\system32\msvcr70.dll 2009-04-18 19:34 . 2009-04-18 20:30 -------- d-----w c:\program files\Total Video Converter 2009-04-18 13:07 . 2009-04-18 13:07 -------- d-----w c:\documents and settings\Daniel\Ustawienia lokalne\Dane aplikacji\vdownloader 2009-04-18 13:07 . 2009-04-18 13:59 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\Desktopicon 2009-04-16 20:54 . 2009-04-23 14:39 -------- d-----w c:\documents and settings\Daniel\.gimp-2.6 2009-04-16 20:54 . 2009-04-16 20:54 -------- d-----w c:\documents and settings\Daniel\.gegl-0.0 2009-04-16 20:53 . 2009-04-16 20:53 -------- d-----w c:\program files\GIMP-2.0 2009-04-16 19:26 . 2009-04-25 11:37 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\AIMP 2009-04-16 19:26 . 2009-04-16 19:26 -------- d-----w c:\program files\AIMP2 2009-04-16 14:21 . 2009-04-16 14:21 -------- d-----w c:\program files\Vimicro 2009-04-16 12:35 . 2009-03-06 14:01 285696 -c----w c:\windows\system32\dllcache\pdh.dll 2009-04-16 12:35 . 2009-02-09 10:03 401408 -c----w c:\windows\system32\dllcache\rpcss.dll 2009-04-16 12:35 . 2009-02-06 09:41 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe 2009-04-16 12:35 . 2005-07-26 04:36 60416 -c----w c:\windows\system32\dllcache\colbact.dll 2009-04-16 12:35 . 2009-02-09 10:03 723456 -c----w c:\windows\system32\dllcache\ntdll.dll 2009-04-16 12:35 . 2009-02-09 10:03 687104 -c----w c:\windows\system32\dllcache\advapi32.dll 2009-04-16 12:35 . 2009-02-09 10:03 473088 -c----w c:\windows\system32\dllcache\fastprox.dll 2009-04-16 12:35 . 2009-02-09 09:55 111104 -c----w c:\windows\system32\dllcache\services.exe 2009-04-16 12:35 . 2009-02-06 09:54 35328 -c----w c:\windows\system32\dllcache\sc.exe 2009-04-16 12:34 . 2009-03-27 07:14 1193414 -c----w c:\windows\system32\dllcache\sysmain.sdb 2009-04-16 12:34 . 2008-04-21 21:28 218112 -c----w c:\windows\system32\dllcache\wordpad.exe 2009-04-14 09:34 . 2007-11-22 21:16 25600 ----a-w c:\windows\system32\borlndmm.dll 2009-04-14 09:34 . 2009-04-14 09:34 -------- d-----w c:\program files\Gizmoz Talking Headz 2009-04-13 21:23 . 2009-04-19 16:43 -------- d-----w c:\program files\SubEdit-Player 2009-04-12 20:19 . 2009-04-12 20:19 -------- d-----w c:\program files\Common Files\Blizzard Entertainment 2009-04-12 19:55 . 2009-04-13 14:05 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\DivX 2009-04-12 19:54 . 2009-02-24 19:35 120056 ------w c:\windows\system32\pxcpyi64.exe 2009-04-12 19:54 . 2009-02-24 19:35 118520 ------w c:\windows\system32\pxinsi64.exe 2009-04-12 19:54 . 2009-04-14 23:29 -------- d-----w c:\program files\DivX 2009-04-12 15:23 . 2009-04-01 21:14 2804893 ----a-w c:\windows\system32\GameMon.des 2009-04-12 15:22 . 2005-01-04 18:43 4682 ----a-w c:\windows\system32\npptNT2.sys 2009-04-12 15:22 . 2003-07-21 03:17 5174 ----a-w c:\windows\system32\nppt9x.vxd 2009-04-12 15:22 . 2009-04-12 15:22 -------- d-----w c:\program files\Common Files\INCA Shared 2009-04-11 19:13 . 2009-04-11 20:30 -------- d-----w c:\windows\system32\CatRoot_bak 2009-04-11 08:44 . 2007-03-10 01:35 100352 -c----w c:\windows\system32\dllcache\6to4svc.dll 2009-04-11 08:40 . 2008-10-03 10:17 247326 -c----w c:\windows\system32\dllcache\strmdll.dll 2009-04-10 22:36 . 2008-06-14 18:01 273024 -c----w c:\windows\system32\dllcache\bthport.sys 2009-04-10 22:36 . 2008-06-14 18:01 273024 ------w c:\windows\system32\drivers\bthport.sys 2009-04-10 22:36 . 2008-08-14 09:48 138368 -c----w c:\windows\system32\dllcache\afd.sys 2009-04-10 22:36 . 2007-07-09 13:20 582656 -c----w c:\windows\system32\dllcache\rpcrt4.dll 2009-04-10 22:33 . 2009-02-09 11:45 2187392 -c----w c:\windows\system32\dllcache\ntoskrnl.exe 2009-04-10 22:33 . 2009-02-09 11:45 2144256 -c----w c:\windows\system32\dllcache\ntkrnlmp.exe 2009-04-10 22:33 . 2009-02-09 11:45 2022400 -c----w c:\windows\system32\dllcache\ntkrpamp.exe 2009-04-10 22:33 . 2009-02-09 11:45 2064256 -c----w c:\windows\system32\dllcache\ntkrnlpa.exe 2009-04-10 22:25 . 2008-05-08 12:14 203008 -c----w c:\windows\system32\dllcache\rmcast.sys 2009-04-10 22:24 . 2008-10-24 11:25 455936 -c----w c:\windows\system32\dllcache\mrxsmb.sys 2009-04-10 22:23 . 2008-06-10 05:07 2376760 -c----w c:\windows\system32\dllcache\WMVCore.dll 2009-04-10 22:22 . 2008-12-11 10:24 333184 -c----w c:\windows\system32\dllcache\srv.sys 2009-04-10 22:22 . 2008-05-01 14:33 331776 -c----w c:\windows\system32\dllcache\msadce.dll 2009-04-10 22:14 . 2008-04-11 18:41 683520 -c----w c:\windows\system32\dllcache\inetcomm.dll 2009-04-10 22:08 . 2008-09-04 16:46 1106944 -c----w c:\windows\system32\dllcache\msxml3.dll 2009-04-10 22:07 . 2008-10-15 16:55 339456 -c----w c:\windows\system32\dllcache\netapi32.dll 2009-04-10 21:20 . 2009-04-10 22:25 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Symantec 2009-04-10 21:19 . 2009-04-10 22:29 -------- d-----w c:\program files\Common Files\Symantec Shared 2009-04-10 21:18 . 2009-04-10 21:18 249856 ------w c:\windows\Setup1.exe 2009-04-10 21:17 . 2009-04-10 21:17 73216 ----a-w c:\windows\ST6UNST.EXE 2009-04-10 21:16 . 2009-04-10 21:26 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\Symantec 2009-04-09 14:38 . 2009-04-09 14:38 -------- d-----w c:\program files\Tibia 2009-04-09 13:41 . 2009-04-09 13:41 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\AdobeUM 2009-04-09 13:41 . 2009-04-09 13:41 -------- d-----w c:\documents and settings\Daniel\Ustawienia lokalne\Dane aplikacji\Adobe 2009-04-09 13:40 . 2009-04-09 13:40 -------- d-----w c:\program files\Common Files\Adobe 2009-04-09 07:46 . 2005-05-26 13:34 2297552 ----a-w c:\windows\system32\d3dx9_26.dll 2009-04-07 14:22 . 2009-04-17 19:46 -------- d-----w c:\program files\HyCam2 2009-04-06 18:27 . 2009-04-23 14:24 69 ----a-w c:\windows\NeroDigital.ini 2009-04-06 17:47 . 2009-04-06 17:47 -------- d--h--w c:\windows\system32\GroupPolicy 2009-04-06 16:30 . 2009-04-06 16:30 -------- d-----w c:\documents and settings\Daniel\Ustawienia lokalne\Dane aplikacji\Help 2009-04-06 15:18 . 2009-04-06 15:18 -------- d-----w c:\windows\Cache 2009-04-06 12:55 . 2009-04-06 12:56 -------- d-----w c:\program files\DAEMON Tools Lite 2009-04-05 21:56 . 2008-03-05 13:56 3786760 ----a-w c:\windows\system32\D3DX9_37.dll 2009-04-05 20:48 . 2009-04-05 20:48 4 ----a-w c:\windows\system32\proc-220146841.bin 2009-04-05 16:12 . 2009-04-05 16:12 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\Media Player Classic 2009-04-04 18:42 . 2009-04-25 11:06 -------- d-----w c:\program files\AutoConnect 2009-04-04 18:07 . 2009-04-12 18:18 -------- d-----w c:\program files\Gadu-Gadu 2009-04-04 15:19 . 2009-04-08 23:41 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\GanymedeNet 2009-04-04 15:18 . 2009-04-14 22:30 -------- d-----w c:\program files\Ganymede 2009-04-03 20:58 . 2009-04-03 20:58 -------- d-----w c:\documents and settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Apple 2009-04-03 20:55 . 2009-04-03 20:55 56 ---ha-w c:\windows\system32\ezsidmv.dat 2009-04-03 20:55 . 2009-04-25 06:07 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\skypePM 2009-04-03 20:54 . 2009-04-25 12:10 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\Skype 2009-04-03 20:53 . 2009-04-03 20:53 -------- d-----w c:\program files\Common Files\Skype 2009-04-03 20:53 . 2009-04-03 20:54 -------- d-----r c:\program files\Skype 2009-04-03 20:53 . 2009-04-03 20:53 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Skype 2009-04-02 15:35 . 2009-04-02 15:35 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\Apple Computer 2009-04-02 01:04 . 2009-04-02 01:04 -------- d-----w c:\documents and settings\Daniel\Ustawienia lokalne\Dane aplikacji\Apple 2009-04-02 01:04 . 2009-04-02 01:04 -------- d-----w c:\documents and settings\Daniel\Ustawienia lokalne\Dane aplikacji\Apple Computer 2009-03-30 17:46 . 2009-03-30 17:47 32785 ----a-w c:\windows\diagerr.xml 2009-03-30 17:46 . 2009-03-30 17:47 2153 ----a-w c:\windows\diagwrn.xml 2009-03-29 11:45 . 2009-03-29 11:45 488 ---ha-r c:\windows\system32\logonui.exe.manifest . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-21 19:01 . 2009-03-27 17:37 -------- d--h--w c:\program files\InstallShield Installation Information 2009-04-21 18:58 . 2009-03-27 17:49 -------- d-----w c:\program files\Common Files\InstallShield 2009-04-20 15:59 . 2007-03-10 01:31 219648 ----a-w c:\windows\system32\uxtheme.dll 2009-04-17 12:11 . 2001-10-26 17:15 75486 ----a-w c:\windows\system32\perfc015.dat 2009-04-17 12:11 . 2001-10-26 17:15 352982 ----a-w c:\windows\system32\perfh015.dat 2009-04-07 16:59 . 2009-03-27 17:50 -------- d-----w c:\program files\Kaspersky Lab 2009-04-06 18:32 . 2009-03-27 17:12 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat 2009-04-06 17:25 . 2009-03-27 17:50 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2009-04-06 05:34 . 2009-03-27 17:48 717296 ----a-w c:\windows\system32\drivers\sptd.sys 2009-03-29 11:42 . 2009-03-27 17:10 23016 ----a-w c:\windows\system32\emptyregdb.dat 2009-03-29 11:11 . 2009-03-27 17:58 98304 ----a-w c:\windows\DUMP412f.tmp 2009-03-28 00:37 . 2009-03-27 18:47 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\Winamp 2009-03-27 18:53 . 2009-03-27 18:47 -------- d-----w c:\program files\Winamp 2009-03-27 17:41 . 2009-03-27 17:41 33 ----a-w c:\windows\system32\drivers\adidsl.cfg 2009-03-27 17:40 . 2009-03-27 17:40 -------- d-----w c:\program files\SAGEM 2009-03-27 17:40 . 2009-03-27 17:40 -------- d-----w c:\documents and settings\Daniel\Dane aplikacji\InstallShield 2009-03-27 17:11 . 2009-03-27 17:11 -------- d-----w c:\program files\Usługi online 2009-03-06 14:01 . 2004-08-03 23:44 285696 ----a-w c:\windows\system32\pdh.dll 2009-02-24 19:35 . 2009-03-27 18:47 129784 ------w c:\windows\system32\pxafs.dll 2009-02-20 08:16 . 2007-01-04 13:05 670720 ----a-w c:\windows\system32\wininet.dll 2009-02-20 08:16 . 2004-08-03 23:44 81920 ----a-w c:\windows\system32\ieencode.dll 2009-02-09 13:56 . 2007-03-10 01:32 1847680 ----a-w c:\windows\system32\win32k.sys 2009-02-09 11:45 . 2006-10-30 06:03 2064256 ----a-w c:\windows\system32\ntkrnlpa.exe 2009-02-09 11:45 . 2007-03-10 01:32 2187392 ----a-w c:\windows\system32\ntoskrnl.exe 2009-02-09 10:03 . 2007-03-10 01:35 730624 ----a-w c:\windows\system32\lsasrv.dll 2009-02-09 10:03 . 2006-09-13 15:30 401408 ----a-w c:\windows\system32\rpcss.dll 2009-02-09 10:03 . 2004-08-03 23:43 687104 ----a-w c:\windows\system32\advapi32.dll 2009-02-09 10:03 . 2004-08-03 23:43 723456 ----a-w c:\windows\system32\ntdll.dll 2009-02-09 09:55 . 2004-08-03 23:44 111104 ----a-w c:\windows\system32\services.exe 2009-02-06 09:54 . 2001-10-26 18:30 35328 ----a-w c:\windows\system32\sc.exe 2009-02-03 19:53 . 2004-08-03 23:44 56320 ----a-w c:\windows\system32\secur32.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-03-27 24103720] "AutoConnect"="c:\program files\AutoConnect\AutoConnect.exe" [2004-08-28 295424] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-04-17 2113536] "Odkurzacz-MCD"="c:\program files\Odkurzacz\odk_mcd.exe" [2008-08-16 264704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016] "BigDog305"="c:\windows\VM305_STI.EXE" [2007-04-09 57344] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-19 148888] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000] "USB Storage Toolbox"="c:\program files\USB Disk Win98 Driver\Res.EXE" [2005-09-14 65536] "SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2005-11-11 90112] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\Daniel\Menu Start\Programy\Autostart\ Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2009-3-27 1205840] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Documents and Settings\\Daniel\\Pulpit\\utorrent.exe"= "c:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"= "c:\\WINDOWS\\system32\\java.exe"= "e:\\NFSMW\\speed.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "e:\\Program Files\\Warcraft III\\Warcraft III.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R2 E4LOADER;General Purpose USB Driver (e4ldr.sys);c:\windows\system32\Drivers\e4ldr.sys [2007-01-04 69656] R3 AVPsys;AVPsys; [x] R3 dump_wmimmc;dump_wmimmc; [x] R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2009-04-01 2804893] R3 NTProcDrv;Process creation detector for NT.; [x] S1 aswSP;avast! Self Protection; [x] S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560] S3 e4usbaw;USB ADSL2 WAN Adapter;c:\windows\system32\DRIVERS\e4usbaw.sys [2007-01-04 104344] S3 ZSMC0305;A4 TECH PC Camera V;c:\windows\system32\Drivers\usbVM305.sys [2006-05-08 391688] . . ------- Skan uzupełniający ------- . IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000 TCP: {874AB105-4D52-4A41-8B7B-EF3F7E13DF65} = 213.241.79.37 83.238.255.76 FF - ProfilePath - c:\documents and settings\Daniel\Dane aplikacji\Mozilla\Firefox\Profiles\426jjagt.default\ FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npganymedenet.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPSOCCER.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-25 14:10 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run BigDog305 = c:\windows\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)???????????????????0?????????@?????????????? skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-343818398-2077806209-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) . Czas ukończenia: 2009-04-25 14:11 ComboFix-quarantined-files.txt 2009-04-25 12:11 Przed: 5 898 338 304 bajtów wolnych Po: 5 886 967 808 bajtów wolnych 271 --- E O F --- 2009-04-17 05:36

Log

**Posty:** 18165 · przez **wojtas** 25 Kwi 2009, 19:21

napisz w jakim pliku Ci wykrywa wirusa..

**Posty:** 8 · przez **LikeThis** 25 Kwi 2009, 19:32

Juz tak dokladnie nie pamietam.
Musialbym zrobic skana wszystkich dyskow ;/ a to trwa ok. 5h +
I bylem taki glupi i nie zapisalem nigdzie gdzie sie znajduje ...

Dodano Dzisiaj, 03:49:
Postanowilem przeskanowac kompa i Avast znalazl :

Kod: Zaznacz wszystko: Plik : C:\System Volume Information\_restore{8AD3CE62-42F6-4B18-81FD-9A120DEB1BAE}\RP36\A0118556.exe\rinst.exe Nazwa pasozyta : Win32:Perflogger-AJ [Trj] Typ pasozyta : Koń trojański Wersja VPS : 090425-0, 2009-04-25 Plik : C:\System Volume Information\_restore{8AD3CE62-42F6-4B18-81FD-9A120DEB1BAE}\RP37\A0118728.exe\rinst.exe Nazwa Pasozyta : Win32:Perflogger-AJ [Trj] Typ pasozyta : Koń trojański Wersja VPS : 090425-0, 2009-04-25

A ten Win32:Rootkit-gen [Rtk] to moze zwykla pomylka ?
Slyszalem ze Avast ma duzo takich przypadkow

Dodano Dzisiaj, 09:45:
Poszukalem na necie i znalazlem stronke ktora analizuje log i wyszlo ze musze usunac :

C:\program files\relevantknowledge\rlvknlg.exe ( ten plik co mowiles )

O4 - HKLM\..\Run: [RelevantKnowledge] C:\program files\relevantknowledge\rlvknlg.exe -boot

O4 - HKCU\..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{874AB105-4D52-4A41-8B7B-EF3F7E13DF65}: NameServer = 213.241.79.37 83.238.255.76 ( nie wiem gdzie to sie znajduje)

O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)

O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)

:-|

**Posty:** 18165 · przez **wojtas** 26 Kwi 2009, 09:46

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem i powinno być ok

pozdro

Autor postu otrzymał pochwałę

**Posty:** 8 · przez **LikeThis** 26 Kwi 2009, 11:32

Wojtas jakiego uzywasz antywirusa ?

:lol:

**Posty:** 18165 · przez **wojtas** 26 Kwi 2009, 21:57

nod32

Kto jest na forum