Znikaniu pulpitu i dolnego paska oraz explorer.exe

**Posty:** 91 · przez **DIIL** 14 Kwi 2009, 19:47

Witam po zainstalowaniu emulatora ps2 i wrzuceniu biosa do folderu z tym emulatorem zaczęły się dziwne rzeczy dziać z moim kompem , po prostu ikony jak i pasek dolny na zmiane się pojawiają i znikaja , jak patrzylem w menagerze zadan to proces explorer.exe tez raz jest a za chwile nie ma i tak na zmiane , a po kilku minutach jak chcę żeby były ikony , to musze samemu uruchomić ten proces a i tak po chwili znika , ale co jest dziwne , nie występują żadne błędy explorer.exe , po prostu pojawia się i znika ... tutaj daje screeny

http://img104.imageshack.us/img104/5612/72574671.jpg
http://img211.imageshack.us/img211/9591/wqeqwe.jpg

domyślam się że to jakich "mocniejszy" wirus ... niestety
chciałem dodać że utrudnione mam teraz korzystanie z kompa , dlatego prosze o jak najłatwiejsze porady ...

jak chcialem wlaczyc tryb awaryjny to nie pojawił sie pulpit , wszystko bylo czarne i tylko na gorze i na dole te napisy WINDOWS XP itd

czekam bo mnie krew zalewa ...

**Posty:** 18165 · przez **wojtas** 14 Kwi 2009, 19:51

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

Autor postu otrzymał pochwałę

**Posty:** 91 · przez **DIIL** 14 Kwi 2009, 20:12

więc tak , czytaj może to co pisze w temacie , żadnych błędów nie mam jednak pobrałem te dwa programy co podales w linku w pierwszym zdaniu i dalej to samo , sdfix nie wlacze bo tryb awaryjny NIE DZIAŁA , jak już pisałem

log hijack

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:10:12, on 2009-04-14 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\UPHClean\uphclean.exe C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\RocketDock\RocketDock.exe C:\Program Files\Desktop Sidebar\dsidebar.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Flock\flock.exe C:\WINDOWS\explorer.exe C:\p\HiJackThis.exe C:\WINDOWS\system32\imapi.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file) O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe" O4 - HKCU\..\Run: [SIDEBAR] "C:\Program Files\Desktop Sidebar\dsidebar.exe" O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: tclock.lnk = C:\p\tclocklight-040702-3\tclock.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O8 - Extra context menu item: Pobierz w Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O8 - Extra context menu item: Pobierz wszystkie pliki w Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Pobierz zaznaczone w Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll O15 - Trusted Zone: http://mks.com.pl O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{64995ABA-9881-4E1E-ACE7-9C182D1EAF87}: NameServer = 217.8.168.244 157.25.5.18 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Usługa inteligentnego transferu w tle (BITS) - Unknown owner - C:\WINDOWS\ O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe -- End of file - 4523 bytes

combo fixa raczej nie rusze , kiedyś problemy jeszcze większe miałem przez niego , no chyba że to nie uniknione ...

log z silenta

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 49, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "AutoConnect" = "C:\Program Files\AutoConnect\AutoConnect.exe" ["http://autoconnect.prv.pl"] "RocketDock" = ""C:\Program Files\RocketDock\RocketDock.exe"" [null data] "SIDEBAR" = ""C:\Program Files\Desktop Sidebar\dsidebar.exe"" ["Idea2"] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTSysVol" = "C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r" ["Creative Technology Ltd"] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] HKLM\Software\Microsoft\Active Setup\Installed Components\ >{26923b43-4d38-484f-9b9e-de460746276c}\(Default) = "Internet Explorer" \StubPath = "C:\windows\system32\ie4uinit.exe -UserIconConfig" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {45AD732C-2CE2-4666-B366-B2214AD57A49}\(Default) = "Idea2 SidebarBrowserMonitor Class" -> {HKLM...CLSID} = "Idea2 SidebarBrowserMonitor Class" \InProcServer32\(Default) = "C:\Program Files\Desktop Sidebar\sbhelp.dll" ["Idea2"] {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\ljJAQGxu.dll" [null data] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre6\bin\ssv.dll" ["Sun Microsystems, Inc."] {d10b34d0-731a-41cc-b418-cfda289052ae}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\tuvWqQkH.dll" [null data] {DBC80044-A445-435b-BC74-9C25C1C588A9}\(Default) = (no title provided) -> {HKLM...CLSID} = "Java(tm) Plug-In 2 SSV Helper" \InProcServer32\(Default) = "C:\Program Files\Java\jre6\bin\jp2ssv.dll" ["Sun Microsystems, Inc."] {E7E6F031-17CE-4C07-BC86-EABFE594F69C}\(Default) = "JQSIEStartDetectorImpl" -> {HKLM...CLSID} = "JQSIEStartDetectorImpl Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll" ["Sun Microsystems, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{B7056B8E-4F99-44f8-8CBD-282390FE5428}" = "VirtualCloneDrive" -> {HKLM...CLSID} = "VirtualCloneDrive Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\ElbyVCDShell.dll" ["Elaborate Bytes AG"] "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" = "UnlockerShellExtension" -> {HKLM...CLSID} = "UnlockerShellExtension" \InProcServer32\(Default) = "C:\Program Files\Unlocker\UnlockerCOM.dll" [null data] "{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx" -> {HKLM...CLSID} = "AlcoholShellEx" \InProcServer32\(Default) = "C:\PROGRA~1\ALCOHO~1\ALCOHO~1\axshlex.dll" ["Alcohol Soft Development Team"] "{611AD258-4138-4348-A534-9856FA6BA398}" = "IconPackager Icon Handler" -> {HKLM...CLSID} = "IPIconHandlerExt Class" \InProcServer32\(Default) = "C:\Program Files\Stardock\Object Desktop\IconPackager\shellext.dll" ["Stardock.net, Inc"] "{1F77B17B-F531-44DB-ACA4-76ABB5010A28}" = "AIMP2: ShellExt" -> {HKLM...CLSID} = "AIMP2: ShellExt" \InProcServer32\(Default) = "C:\PROGRA~1\AIMP2\System\AIMP_S~1.DLL" ["AIMP DevTeam"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WRaR\rarext.dll" [null data] "{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" = "OpenOffice.org Column Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{087B3AE3-E237-4467-B8DB-5A38AB959AC9}" = "OpenOffice.org Infotip Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice.org Property Sheet Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{3B092F0C-7696-40E3-A80F-68D74DA84210}" = "OpenOffice.org Thumbnail Viewer" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{10677009-C23C-4FC2-A62C-29323A2201F0}" = "AQQ File Transfer Shell Extension" -> {HKLM...CLSID} = "AQQ File Transfer Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\WapSter\WAPSTE~1\System\AQQSHE~1.DLL" [null data] "{F2185E5D-720E-4956-90D9-75F6AC141575}" = "Idea2 SidebarIconHandler Class" -> {HKLM...CLSID} = "SidebarIconHandler Class" \InProcServer32\(Default) = "C:\Program Files\Desktop Sidebar\sbhelp.dll" ["Idea2"] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\windows\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\windows\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\windows\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\windows\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\windows\system32\nvshell.dll" ["NVIDIA Corporation"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <<!>> "{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}" = "*n" (unwritable string) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\ljJAQGxu.dll" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\windows\system32\WPDShServiceObj.dll" [MS] HKLM\System\CurrentControlSet\Control\Session Manager\ <<!>> "BootExecute" = "autocheck autochk *"|"OODBS" [file not found] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> ljJAQGxu\DLLName = "ljJAQGxu.dll" [null data] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\(Default) = "OpenOffice.org Column Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] AIMPClassic\(Default) = "{1F77B17B-F531-44DB-ACA4-76ABB5010A28}" -> {HKLM...CLSID} = "AIMP2: ShellExt" \InProcServer32\(Default) = "C:\PROGRA~1\AIMP2\System\AIMP_S~1.DLL" ["AIMP DevTeam"] AQQFileTransfer\(Default) = "{10677009-C23C-4FC2-A62C-29323A2201F0}" -> {HKLM...CLSID} = "AQQ File Transfer Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\WapSter\WAPSTE~1\System\AQQSHE~1.DLL" [null data] LavasoftShellExt\(Default) = "{DCE027F7-16A4-4BEE-9BE7-74F80EE3738F}" -> {HKLM...CLSID} = "Lavasoft Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Lavasoft\Ad-Aware\ShellExt.dll" [file not found] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WRaR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] AIMPClassic\(Default) = "{1F77B17B-F531-44DB-ACA4-76ABB5010A28}" -> {HKLM...CLSID} = "AIMP2: ShellExt" \InProcServer32\(Default) = "C:\PROGRA~1\AIMP2\System\AIMP_S~1.DLL" ["AIMP DevTeam"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WRaR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ LavasoftShellExt\(Default) = "{DCE027F7-16A4-4BEE-9BE7-74F80EE3738F}" -> {HKLM...CLSID} = "Lavasoft Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Lavasoft\Ad-Aware\ShellExt.dll" [file not found] UnlockerShellExtension\(Default) = "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" -> {HKLM...CLSID} = "UnlockerShellExtension" \InProcServer32\(Default) = "C:\Program Files\Unlocker\UnlockerCOM.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WRaR\rarext.dll" [null data] HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ UnlockerShellExtension\(Default) = "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" -> {HKLM...CLSID} = "UnlockerShellExtension" \InProcServer32\(Default) = "C:\Program Files\Unlocker\UnlockerCOM.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoCDBurning" = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "%APPDATA%\Flock\Browser\Desktop Background.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\lukasz\Dane aplikacji\Flock\Browser\Desktop Background.bmp" Startup items in "lukasz" & "All Users" startup folders: -------------------------------------------------------- C:\Documents and Settings\lukasz\Menu Start\Programy\Autostart "tclock" -> shortcut to: "C:\p\tclocklight-040702-3\tclock.exe" ["Kazubon"] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W" [empty string] Enabled Scheduled Tasks: ------------------------ "Ad-Aware Update (Weekly)" -> launches: "C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe update all silent" [file not found] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 16 %SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06 Toolbars, Explorer Bars, Extensions: ------------------------------------ Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_11" \InProcServer32\(Default) = "C:\Program Files\Java\jre6\bin\jp2iexp.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_11" \InProcServer32\(Default) = "C:\Program Files\Java\jre6\bin\npjpi160_11.dll" ["Sun Microsystems, Inc."] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ User Profile Hive Cleanup, UPHClean, "C:\Program Files\UPHClean\uphclean.exe" [MS] Windows Driver Foundation - User-mode Driver Framework, WudfSvc, "C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup" {"C:\WINDOWS\System32\WUDFSvc.dll" [MS]} Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ EPSON V6 Monitor4SA\Driver = "EBPMON24.DLL" ["SEIKO EPSON CORPORATION"] ---------- <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 26 seconds, including 3 seconds for message boxes)

**Posty:** 18165 · przez **wojtas** 14 Kwi 2009, 21:00

DIIL napisał(a):czytaj może to co pisze w temacie

Ty jakbys był uprzejmy i oczytany to bys wiedział ze gdy mamy problem z wirusami dajemy na poczatek 2 logi z combofixa i hijacka... i nie było by tyle zbędnych postów...

**Posty:** 91 · przez **DIIL** 14 Kwi 2009, 21:29

sorry jestem nabuzowany bo już sił nie mam , combo fixem przeskanowalem to przez 5 minut bylo ok , jak wszedlem do moj komputer to znowu padło

, wg mnie to cos z explorer.exe jest

Kod: Zaznacz wszystko: ComboFix 09-04-14.09 - lukasz 2009-04-14 20:55.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.2047.1756 [GMT 2:00] Uruchomiony z: c:\documents and settings\lukasz\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\lukasz\Pulpit\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\docume~1\lukasz\USTAWI~1\Temp\1.html c:\windows\config.ini c:\windows\system32\drivers\ovfsthqdylpboasrmyxklnvaprkfunrfubhyyx.sys c:\windows\system32\HkQqWvut.ini c:\windows\system32\HkQqWvut.ini2 c:\windows\system32\ovfsthlleasstlomwvaqfjvoolkdtomgnoubgi.dll c:\windows\system32\ovfsthoxrgvocrmnkuqstqsafcjtwmepktprka.dat c:\windows\system32\ovfsthvtkficawycrgvmjhnmsfllslkbcwlfmm.dat c:\windows\system32\ovfsthvyljkrmyqiqjqgowpxsvxrkyrqjwyhoe.dll c:\windows\system32\ovfsthyfncxltdqtqgirryhvggeyyvrtwhqppw.dll c:\windows\system32\tuvWqQkH.dll . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_ovfsthwnkndjbimxfqhhbebuovtkdldedxvnmt -------\Legacy_MSDIRECTX -------\Legacy_OREANS32 -------\Service_oreans32 ((((((((((((((((((((((((( Pliki utworzone od 2009-03-14 do 2009-04-14 ))))))))))))))))))))))))))))))) . 2009-04-14 17:38 . 2009-04-14 17:38 -------- d-----w C:\ERDNT 2009-04-14 17:38 . 2009-04-14 17:38 -------- d-----w c:\windows\ERUNT 2009-04-14 17:38 . 2009-04-14 17:38 -------- d-----w C:\!FixIEDef 2009-04-14 17:14 . 2009-04-14 19:04 109010 ----a-w c:\windows\system32\drivers\2a598b0a.sys 2009-04-14 16:51 . 2009-04-14 16:51 2560 ----a-w c:\windows\system32\vtUmMdBq.dll 2009-04-14 16:51 . 2009-04-14 16:51 39424 ----a-w c:\windows\system32\ljJAQGxu.dll 2009-04-13 11:55 . 2009-04-13 11:55 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\Braid 2009-04-13 10:12 . 2009-04-13 10:12 -------- d-----w C:\WEOL'08 3.0 2009-04-10 18:52 . 2009-04-10 18:52 -------- d-----w c:\windows\system32\URTTEMP 2009-04-09 20:31 . 2009-04-09 20:33 -------- d-----w c:\windows\SxsCaPendDel 2009-04-08 13:55 . 2009-04-08 15:32 -------- d-----w C:\faef81f2e24a5db88ff9b0 2009-04-06 10:15 . 2009-04-06 10:15 -------- d-----w c:\documents and settings\lukasz\Ustawienia lokalne\Dane aplikacji\Aspyr 2009-04-04 21:53 . 2009-04-04 21:53 172772 ----a-w c:\windows\system32\winamp55551_pro_all.exe 2009-04-04 18:43 . 2009-04-14 16:43 33 ----a-w c:\windows\gen_nic.ini 2009-04-03 17:44 . 2009-04-03 17:44 -------- d-----w c:\documents and settings\lukasz\Ustawienia lokalne\Dane aplikacji\EA Games 2009-04-03 10:21 . 2009-04-03 10:21 54156 ---ha-w c:\windows\QTFont.qfn 2009-04-03 10:21 . 2009-04-03 10:21 1409 ----a-w c:\windows\QTFont.for 2009-03-30 18:18 . 2009-03-30 18:21 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\Mp3tag 2009-03-30 10:22 . 2009-03-30 18:52 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\Sony 2009-03-30 10:22 . 2009-03-30 10:22 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Sony 2009-03-30 10:21 . 2009-03-30 18:52 -------- d-----w c:\documents and settings\lukasz\Ustawienia lokalne\Dane aplikacji\Sony 2009-03-30 10:19 . 2009-03-30 10:19 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple 2009-03-29 10:02 . 2009-03-29 10:14 -------- d-----w c:\documents and settings\lukasz\Ustawienia lokalne\Dane aplikacji\Wheelman 2009-03-29 10:02 . 2009-03-29 10:02 -------- d-----w c:\documents and settings\lukasz\Ustawienia lokalne\Dane aplikacji\PC 2009-03-19 17:23 . 2009-04-10 18:26 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\TrackMania 2009-03-19 16:35 . 2009-03-19 16:35 -------- d-----w c:\documents and settings\LocalService\Pulpit 2009-03-18 18:17 . 2009-03-18 18:17 -------- d-----w C:\Games 2009-03-16 21:13 . 2009-04-06 10:08 1355 ----a-w c:\windows\imsins.BAK 2009-03-16 15:05 . 2009-03-16 18:40 475 ----a-w c:\windows\FOE2.ini . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-14 19:04 . 2008-10-10 22:03 -------- d-----w c:\program files\AutoConnect 2009-04-14 18:04 . 2008-10-15 20:46 -------- d-----w c:\program files\Flock 2009-04-14 16:51 . 2007-06-24 18:25 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\uTorrent 2009-04-14 11:17 . 2008-07-03 17:03 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\OpenOffice.org2 2009-04-14 00:40 . 2007-10-07 08:41 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\Desktop Sidebar 2009-04-14 00:15 . 2006-10-12 18:22 -------- d-----w c:\program files\eMule 2009-04-11 19:03 . 2009-04-11 19:03 -------- d-----w c:\program files\1C Publishing EU 2009-04-11 19:03 . 2006-10-12 16:43 -------- d--h--w c:\program files\InstallShield Installation Information 2009-04-10 19:27 . 2001-10-26 14:15 89364 ----a-w c:\windows\system32\perfc015.dat 2009-04-10 19:27 . 2001-10-26 14:15 500378 ----a-w c:\windows\system32\perfh015.dat 2009-04-09 21:55 . 2009-04-09 21:55 -------- d-----w c:\program files\Sports Interactive 2009-04-09 20:41 . 2006-10-12 17:49 23760 -c--a-w c:\documents and settings\lukasz\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-04-09 20:39 . 2008-11-03 22:47 78512 ----a-w c:\documents and settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat 2009-04-08 18:04 . 2009-03-24 21:04 -------- d-----w c:\program files\Ricochet Infinity 2009-04-08 13:00 . 2008-01-31 18:14 -------- d-----w c:\program files\Paint.NET 2009-04-08 10:42 . 2009-03-02 22:34 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Synetic 2009-04-07 22:10 . 2009-01-19 22:54 427 ----a-w C:\m.txt 2009-04-07 10:43 . 2009-04-07 10:43 -------- d-----w c:\program files\GameSpy Arcade 2009-04-07 10:40 . 2009-04-07 10:40 -------- d-----w c:\program files\Aspyr 2009-04-05 19:06 . 2006-10-13 07:13 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\Free Download Manager 2009-04-05 11:21 . 2009-04-05 11:21 -------- d-----w c:\program files\Blade 2009-04-04 21:54 . 2006-10-12 18:08 -------- d-----w c:\program files\Winamp 2009-04-04 21:54 . 2008-03-28 20:28 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\Winamp 2009-04-03 17:32 . 2008-11-18 12:00 -------- d-----w c:\program files\EA Games 2009-04-01 14:55 . 2009-04-01 14:55 -------- d-----w c:\program files\Eidos 2009-04-01 14:06 . 2007-07-03 18:03 22328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2009-04-01 14:06 . 2007-07-27 16:30 103736 ----a-w c:\windows\system32\PnkBstrB.exe 2009-03-31 09:43 . 2007-03-19 09:07 -------- d-----w c:\program files\Common Files\Wise Installation Wizard 2009-03-31 09:43 . 2007-03-19 09:07 -------- d-----w c:\program files\AGEIA Technologies 2009-03-30 18:18 . 2009-03-30 18:18 -------- d-----w c:\program files\Mp3tag 2009-03-30 10:19 . 2009-03-30 10:19 -------- d-----w c:\program files\QuickTime 2009-03-30 10:19 . 2007-06-24 22:15 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2009-03-30 10:19 . 2009-03-30 10:19 -------- d-----w c:\program files\Apple Software Update 2009-03-29 13:50 . 2009-03-27 15:09 -------- d-----w c:\program files\RADVideo 2009-03-29 09:50 . 2009-03-29 09:50 -------- d-----w c:\program files\Ubisoft Entertainment 2009-03-29 09:33 . 2009-01-25 18:00 -------- d-----w c:\program files\America's Army 2009-03-29 09:32 . 2009-01-28 12:28 -------- d-----w c:\program files\Skispringen 2007 2009-03-28 10:45 . 2009-02-23 11:41 -------- d-----w c:\program files\Last.fm 2009-03-27 14:59 . 2009-03-27 14:59 -------- d-----w c:\program files\BreakPoint Software 2009-03-27 10:09 . 2009-03-27 09:51 -------- d-----w c:\program files\Microsoft ActiveSync 2009-03-24 19:32 . 2009-03-24 19:32 -------- d-----w c:\program files\DX-Ball 2009-03-23 15:44 . 2009-03-19 22:27 -------- d-----w c:\program files\Silkroad 2009-03-20 20:15 . 2009-03-20 20:15 -------- d-----w c:\program files\THQ 2009-03-20 01:57 . 2009-03-16 14:47 -------- d-----w c:\program files\EA Sports 2009-03-19 20:23 . 2008-01-30 19:38 -------- d-----w c:\program files\SpeedFan 2009-03-19 17:16 . 2009-03-19 16:27 -------- d-----w c:\program files\Lavasoft 2009-03-19 17:16 . 2009-01-10 21:31 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Lavasoft 2009-03-19 17:15 . 2007-10-26 16:58 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2009-03-19 14:11 . 2009-02-04 10:38 -------- d-----w c:\program files\Electronic Arts 2009-03-19 13:51 . 2007-07-27 16:30 66872 ----a-w c:\windows\system32\PnkBstrA.exe 2009-03-17 14:09 . 2009-03-17 14:09 -------- d-----w c:\program files\UPHClean 2009-03-17 13:57 . 2006-10-12 16:43 -------- d-----w c:\program files\Java 2009-03-17 13:57 . 2008-01-14 22:05 -------- d-----w c:\program files\Ganymede 2009-03-16 20:26 . 2009-03-16 20:24 -------- d-----w c:\program files\TmNationsForever 2009-03-16 11:05 . 2008-10-15 19:29 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\Apple Computer 2009-03-14 21:05 . 2009-03-14 21:05 230752 ----a-w c:\windows\patchw32.dll 2009-03-14 17:51 . 2006-12-04 21:53 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\Skype 2009-03-14 16:08 . 2009-01-27 20:50 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\skypePM 2009-03-09 22:40 . 2006-11-06 15:18 -------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-03-09 22:10 . 2008-04-03 16:46 -------- d-----w c:\program files\CCleaner 2009-03-01 11:13 . 2009-03-01 11:13 -------- d-----w c:\program files\Sierra Entertainment 2009-02-28 18:00 . 2009-02-02 12:57 -------- d-----w c:\program files\Microsoft Games for Windows - LIVE 2009-02-26 13:08 . 2009-02-26 13:08 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\id Software 2009-02-26 13:07 . 2007-11-19 19:28 22328 -c--a-w c:\documents and settings\lukasz\Dane aplikacji\PnkBstrK.sys 2009-02-26 13:07 . 2007-11-19 19:28 2246144 ----a-w c:\windows\system32\pbsvc.exe 2009-02-25 23:39 . 2009-01-15 14:49 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Electronic Arts 2009-02-23 22:53 . 2007-09-21 09:32 -------- d-----w c:\program files\The KMPlayer 2009-02-23 11:42 . 2009-02-23 11:42 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Last.fm 2009-02-19 18:07 . 2008-11-03 14:35 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Sports Interactive 2009-02-19 18:05 . 2006-10-24 17:12 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\Sports Interactive 2009-02-19 14:49 . 2008-10-14 11:27 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\AIMP 2009-02-02 21:28 . 2009-02-02 23:14 258352 ----a-w c:\windows\system32\unicows.dll 2008-04-17 21:09 . 2008-04-17 21:09 81920 ----a-w c:\documents and settings\lukasz\Dane aplikacji\ezpinst.exe 2008-04-17 21:09 . 2008-04-17 21:09 47360 ----a-w c:\documents and settings\lukasz\Dane aplikacji\pcouffin.sys 2007-04-25 09:17 . 2007-04-25 09:17 131 -c--a-w c:\documents and settings\lukasz\Ustawienia lokalne\Dane aplikacji\fusioncache.dat . ------- Sigcheck ------- [-] 2007-11-04 14:58 359040 C81D6A930A7805F6DAA0C7902B99037E c:\windows\system32\dllcache\tcpip.sys [-] 2007-11-04 14:58 359040 C81D6A930A7805F6DAA0C7902B99037E c:\windows\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}] 2009-04-14 16:51 39424 ----a-w c:\windows\system32\ljJAQGxu.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoConnect"="c:\program files\AutoConnect\AutoConnect.exe" [2006-12-02 310784] "RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616] "SIDEBAR"="c:\program files\Desktop Sidebar\dsidebar.exe" [2006-07-09 1777664] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 57344] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\lukasz\Menu Start\Programy\Autostart\ tclock.lnk - c:\p\tclocklight-040702-3\tclock.exe [2007-12-4 44544] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-7-23 966756] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}"= "c:\windows\system32\ljJAQGxu.dll" [2009-04-14 39424] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljJAQGxu] 2009-04-14 16:51 39424 ----a-w c:\windows\system32\ljJAQGxu.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\[u]0[/u]OODBS [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Exif Launcher.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Exif Launcher.lnk backup=c:\windows\pss\Exif Launcher.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] c:\windows\system32\dumprep 0 -k [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray] 2005-05-19 13:47 57344 -c--a-w c:\program files\SlySoft\CloneCD\CloneCDTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C45 Series] 2004-01-14 01:00 99840 -c--a-w c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I3T1.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2001-07-09 09:50 155648 ----a-w c:\windows\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] 2009-01-15 07:19 13680640 ----a-w c:\windows\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] 2009-01-15 07:19 86016 ----a-w c:\windows\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2007-10-19 18:16 286720 ----a-w c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\REGSHAVE] 2002-02-04 20:32 53248 -c----w c:\program files\REGSHAVE\REGSHAVE.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] 2008-11-18 15:31 21633320 ----a-r c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2008-12-17 20:02 136600 ----a-w c:\program files\Java\jre6\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPP Auto Loader] 2006-04-13 14:28 118784 -c--a-r c:\windows\TPPALDR.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg] 2000-05-10 23:00 90112 -c----w c:\windows\Updreg.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive] 2006-04-29 13:21 94208 -c--a-w c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] 2009-01-15 07:19 1657376 ----a-w c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P17Helper] 2005-05-03 11:38 64512 ----a-r c:\windows\system32\P17.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Tlen.pl\\tlen.exe"= "c:\\Program Files\\Silkroad\\SilkErrSender.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\TVUPlayer\\TVUPlayer.exe"= "c:\\Program Files\\SopCast\\SopCast.exe"= "c:\\Documents and Settings\\lukasz\\Dane aplikacji\\SopCast\\adv\\SopAdver.exe"= "c:\\Program Files\\TVAnts\\Tvants.exe"= "c:\\Program Files\\Aspyr\\MTX\\Game\\MTX.exe"= "c:\\Program Files\\uTorrent\\utorrent.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\Last.fm\\LastFM.exe"= "c:\\WINDOWS\\system32\\dplaysvr.exe"= "c:\\p\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\TmNationsForever\\TmForever.exe"= "c:\\Program Files\\WapSter\\WapSter AQQ\\AQQ.exe"= "c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"= "c:\\Program Files\\Flock\\flock.exe"= "c:\\Program Files\\eMule\\emule.exe"= "c:\\Program Files\\Outspark\\Project Powder\\Run.exe"= "c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutLauncher.exe"= "c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutConfigTool.exe"= "c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutParadise.exe"= "c:\\Program Files\\Java\\jre6\\bin\\java.exe"= "c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic.exe"= "c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_online.exe"= "c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_ds.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\EA Games\\Ojciec chrzestny II\\godfather2.exe"= "c:\\Program Files\\Sports Interactive\\Football Manager 2009\\fm.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8080:TCP"= 8080:TCP:ściąganie "60100:TCP"= 60100:TCP:utorrent port R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 16512] R3 cpuz130;cpuz130; [x] R3 PortTalk;PortTalk;c:\windows\system32\Drivers\PortTalk.sys [2002-01-12 3567] R3 PPJoyBus;Parallel Port Joystick Bus device driver;c:\windows\system32\drivers\PPJoyBus.sys [2003-08-10 11330] R3 PPortJoystick;Parallel Port Joystick device driver;c:\windows\system32\drivers\PPortJoy.sys [2004-10-24 28800] R3 TPPFX;USB Storage Adapter FX (TPP);c:\windows\system32\DRIVERS\TPPFX.SYS [2006-04-13 32256] R3 XDva120;XDva120; [x] R3 XDva208;XDva208; [x] R3 XDva215;XDva215; [x] R3 XDva248;XDva248; [x] R4 HDDlife HDD Access service;HDDlife HDD Access service; [x] --- Inne Usługi/Sterowniki w Pamięci --- *Deregistered* - uphcleanhlp . Zawartość folderu 'Zaplanowane zadania' . - - - - USUNIĘTO PUSTE WPISY - - - - BHO-{5c9a62c3-94a5-4a59-89b7-41b660981b14} - c:\windows\system32\tuvWqQkH.dll MSConfigStartUp-BitTorrent DNA - c:\program files\DNA\btdna.exe MSConfigStartUp-CloneDVDElbyDelay - c:\program files\Elaborate Bytes\CloneDVD\ElbyCheck.exe MSConfigStartUp-DAEMON Tools - c:\program files\DAEMON Tools\daemon.exe MSConfigStartUp-ISUSPM - c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe MSConfigStartUp-MtdAcqu - c:\program files\Creative\MediaSource5\MtdAcqu.exe MSConfigStartUp-TkBellExe - c:\program files\Common Files\Real\Update_OB\realsched.exe MSConfigStartUp-Vistadrv - c:\program files\Vista\systool\Vistadrive\vsdrv.exe MSConfigStartUp-WinampAgent - c:\program files\Winamp\winampa.exe MSConfigStartUp-Alcmtr - ALCMTR.EXE MSConfigStartUp-RTHDCPL - RTHDCPL.EXE MSConfigStartUp-SkyTel - SkyTel.EXE . ------- Skan uzupełniający ------- . IE: Download all with Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm IE: Download selected with Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm IE: Download with Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm IE: Pobierz w Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm IE: Pobierz wszystkie pliki w Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm IE: Pobierz zaznaczone w Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm Trusted Zone: com.pl\mks TCP: {64995ABA-9881-4E1E-ACE7-9C182D1EAF87} = 217.8.168.244 157.25.5.18 DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab FF - ProfilePath - c:\documents and settings\lukasz\Dane aplikacji\Mozilla\Firefox\Profiles\ux1iy719.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - www.wp.pl FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p= FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMAKAOV2.dll ---- FIREFOX - SPOSÓB POSTĘPOWANIA ---- FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: content.max.tokenizing.time - 200000 FF - user.js: content.notify.interval - 100000 FF - user.js: content.switch.threshold - 650000 FF - user.js: nglayout.initialpaint.delay - 300 . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-14 21:04 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\2a598b0a] "ImagePath"="\SystemRoot\System32\drivers\2a598b0a.sys" . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\s-1-5-21-682003330-1177238915-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID] @Denied: (Full) (LocalSystem) [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*] "OODEFRAG08.00.00.01WORKSTATION"="095B648FC2CBBC16DC5762DEA70ED780BE4482F18D7D2D8E144AC36C31E4D6F4B01C156D72F1DA74D6E88011456DFE638E5D248BE987E2D44D3AF84C7A2F773BE26F6DB5C8FDBAB245D84CE30C35C9C521777405574641D33F4966BB6E6BEEF93A2A921559D44F937F448F18DAE162CA28978550256EC6329C087FFBE6A8AFF683817FBFAC7C222110AA69EE0A15855A0DA639DF14DA855748670ED3B499C13DC112806C3EA3CDA2B4EFCB325F1205A26970C7AEDB882373DA3EAE8C9915BF9AA85BB7D3FD99842B60DD7F2C1AC2C4110EA9BDB7A4995AF3A0C6D2F3CC1758A0A2411CB5CF50090B3AA09CAD6935405CFD65F9FB8EFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E667A6171C11EC38DE3DA9C6AECB7A5D1407C038D530D6EB3452A34377657AEE3390A9F86740DE80F081D38498D816C980D5DA3D8A265F947B7D3ABC47869B533CB0EE2A7A11CEA4F9A6BE62063AAF14E9A717E039CA50B7F964F0050CA1CA14162850A1694A87D9FC4ECD5C94DE0DE92795AF5F93BF65ADBF3A16592F160D462ADE34CE80A7F7F914CD9CB711FE2607A28499F385DABDB8278D188AE0F54A4CE0322337511A72AD5AEEEE4F0D87D2FECAC9F06E4124DDEE0E648B7C93074E64ADF24A742FC3AAF672712A115C1853B3103073323DDBACB8D7B627267F44CB1D8167793431FB3AA87F8556FE9B864A5F6877043635F0F554E96E49969FDC56575447A6B6B4CF20EAAA51A4AFA35ABC0F4D532B05A48AE7D3B06DEFEA32B2E4CAA2C06AD2D87DBCB99F70E4CD19CF96A1BCE993BECF01189C19863FD93B5DD403EBF381EF847854E3116E0D175FD8A5CE38D60A183C627B6917047FA90125665E33F54C8CDB69928E31D0B75E1F981C1D45A80354B2F0EEC7A19F1C398F8B3E8F004FD0B84D2B83303B0AA20947680FE9ED6215D2C321B097B189257635BF659C607E381C894C98946A062F1208D37B663F7A7C01409D66114766CE67852B46E0DF73CD6D839127DC7EA2E388569C3E164C5D95E13E4294BD64CE7023D8E6B30B9613837CF372E87CBD32E90CEBB69A5429E8648D18A129F810CD07D448C1609E19B76E28D61A7BB9F07810D545CB36CA707011AEEA02717754E431BF33BE6572032DC6E66CE85FB1E2B248AE24361B7CBE3CE5059B5B23BDC08534363F923E2FF5346AC0B771FA54650EA7F48D08B9BDB685CF634EDBD325689976A1CFAA4DD6158359D504FA17E44E2AE71B4A8462377D7B64326C657F5CDFFD85FC14235539864239545981627A7420E8A767264B643DC259EA268D8464C2008FD8F6CF7F7E778ED0838AB4EB03B479AAB4B7971197A3EF891EEC1DA814B1E5E959AFB6D721967910BB2B78AABB70B1D2704D3AAF756111F2EDF5" "OODEFRAG11.00.00.01WORKSTATION"="6A3919A1AA962BE400F5202CA754AB0F68E36AF32D4D5F0FCD6429E84E8CB7C18A25B8D42AD39CEBCF0D4F39420C0F61AE4007C1A34F8E42E5AB2D4EDAF9D6467FA1EA7DC4D8F393C58BB7CEA05A92ACFD261FDDF9D5B5E981D1519B6363328216708D247A42F5A8A0D2D3A2C7CB29B52BB7E743DC819AE0AA5B27B3D69BFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B9808A2D97226D213B555A6171C11EC38DE3DBB0154529664DFDC7F5FFC76AC99FE75D8E4BAC547AF72B3A302B94357042AB6BBF5CEC5569C2CA969064688A2290DD92049094D1F98B95D88060505AA388FC86016789062E7C4F521687810385DA15B830558C1D47385F1C82C56EF4E12452BD37F1CED2C9BCE781D3C14283BF024E168848041B18522AAD4BBF7C4A7801B8938711B5E546FBEEDCC5A2C30A9874F5BA9D86BABB37A3045171FC982CFD7B89021CF69A4B20060160EBE6CCDB6A5B5B694B917A608DFA503E6653FF1944F977596228F474FCED2B3B80B91E84AB338E8EA80169C1628C9AA9641609B7681046D949429126B3E088F16846C2D01818FECE32B0EB8F4A83A84678A47CDACEDA1330AF666937997C7F3E014620B29BE48BC27DABA6D721E675F10BAA29BA0796506DBBD0C9F9D882CB14B456D36470141D956D5686E0EA5950D3D7138DAEDE81927E20072CDB41FA39BF9C91A2791422F4980077AB6FBC1DFE18C72DC25E76A5A5FE9790677CC52F10A07F7899A74DE9814AC7AE60225D830B891A27C59148B9BF6B20C47BC27F7AC587E4671100F195AC55563B8D22735C8ED530F9798AAC0A13E6E39C802BB4E4066E0539BCAB596A36F67180D6CD0063EE4CC653FC91AE00807472A34EB3575E99625DFE354EEE0F8A5C59096D9A85C7981ECF71C1704A63A2959AA46E770703DD2B2CEBCF8F663B102C66C9CE7E42FB6AE173F6A6E3EB2FA7EB22A4E2401A92184662CAA483C71781F336C782773D9865A2255F7825188E0E4D93D3113ADECCF9D12234816E3C0CE204AF798EC75195074587927C8FA0F54C0469B666D71E9D78FFA84C1FB45E88728BD187ED13D114874790E72FBAD1194F6E120FBAD79359DD259C5D753E9E8CADFB2F9C1345546FED2B81AE1990DBE32730F4C1012A8C7D563DB7F613F93A094F344700C34F925540EBC481764742B13A4A043D79E957E8C41A16E46A235D7B39680F19BB79AFAFBA6A1E744E1F1CEF1FCDFCC1C9B8B97206FBFF305A5F436CC79691743E7DCF800A3F36C30DC4583DAF18755B7118839C274BF15AD34B04957D8F31EE7B019383C0D3A6C366264883280C7EB1CD13E6B7DDE9FF9E5FEF5039F6E0B6906C4DB316272E7A1C746F8832B26C445CEEE159B283C4F6FE77989B745FB8C7E" . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(672) c:\windows\system32\ljJAQGxu.dll - - - - - - - > 'explorer.exe'(276) c:\program files\RocketDock\RocketDock.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\nvsvc32.exe c:\windows\system32\PnkBstrA.exe c:\program files\UPHClean\uphclean.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: ~,10time:~,-3machine was rebootedCombobatch-by ComboFix-quarantined-files.txt 2009-04-14 19:07 Przed: 15 391 391 744 bajtów wolnych Po: 15 847 350 272 bajtów wolnych WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect 335

**Posty:** 18165 · przez **wojtas** 14 Kwi 2009, 21:44

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}]

[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\2a598b0a]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljJAQGxu]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}"=-

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

Otworz notatnik i wklej w nim to:

File::
c:\windows\system32\drivers\2a598b0a.sys
c:\windows\system32\vtUmMdBq.dll
c:\windows\system32\ljJAQGxu.dll

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 91 · przez **DIIL** 14 Kwi 2009, 21:47

ok już robie a tak w kwestii nadziei , wiesz o co chodzi mniej wiecej ?? co to za cholerstwo ?

**Posty:** 18165 · przez **wojtas** 14 Kwi 2009, 21:50

jakis wirus... powalczymy z nim i poczekamy na efekty.

**Posty:** 91 · przez **DIIL** 14 Kwi 2009, 22:17

Kod: Zaznacz wszystko: ComboFix 09-04-14.09 - lukasz 2009-04-14 21:55.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.2047.1504 [GMT 2:00] Uruchomiony z: c:\documents and settings\lukasz\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\lukasz\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\pmnoNHXq.dll c:\windows\system32\qXHNonmp.ini c:\windows\system32\qXHNonmp.ini2 . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_CPUZ130 -------\Legacy_XDVA120 -------\Legacy_XDVA208 -------\Legacy_XDVA215 -------\Legacy_XDVA248 -------\Service_2a598b0a -------\Service_cpuz130 -------\Service_XDva120 -------\Service_XDva208 -------\Service_XDva215 -------\Service_XDva248 ((((((((((((((((((((((((( Pliki utworzone od 2009-03-14 do 2009-04-14 ))))))))))))))))))))))))))))))) . 2009-04-14 17:38 . 2009-04-14 17:38 -------- d-----w C:\ERDNT 2009-04-14 17:38 . 2009-04-14 17:38 -------- d-----w c:\windows\ERUNT 2009-04-14 17:38 . 2009-04-14 19:20 -------- d-----w C:\!FixIEDef 2009-04-14 17:14 . 2009-04-14 20:02 109010 ----a-w c:\windows\system32\drivers\2a598b0a.sys 2009-04-14 16:51 . 2009-04-14 16:51 2560 ----a-w c:\windows\system32\vtUmMdBq.dll 2009-04-14 16:51 . 2009-04-14 16:51 39424 ----a-w c:\windows\system32\ljJAQGxu.dll 2009-04-13 11:55 . 2009-04-13 11:55 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\Braid 2009-04-13 10:12 . 2009-04-13 10:12 -------- d-----w C:\WEOL'08 3.0 2009-04-10 18:52 . 2009-04-10 18:52 -------- d-----w c:\windows\system32\URTTEMP 2009-04-09 20:31 . 2009-04-09 20:33 -------- d-----w c:\windows\SxsCaPendDel 2009-04-08 13:55 . 2009-04-08 15:32 -------- d-----w C:\faef81f2e24a5db88ff9b0 2009-04-06 10:15 . 2009-04-06 10:15 -------- d-----w c:\documents and settings\lukasz\Ustawienia lokalne\Dane aplikacji\Aspyr 2009-04-04 21:53 . 2009-04-04 21:53 172772 ----a-w c:\windows\system32\winamp55551_pro_all.exe 2009-04-04 18:43 . 2009-04-14 19:21 33 ----a-w c:\windows\gen_nic.ini 2009-04-03 17:44 . 2009-04-03 17:44 -------- d-----w c:\documents and settings\lukasz\Ustawienia lokalne\Dane aplikacji\EA Games 2009-04-03 10:21 . 2009-04-03 10:21 54156 ---ha-w c:\windows\QTFont.qfn 2009-04-03 10:21 . 2009-04-03 10:21 1409 ----a-w c:\windows\QTFont.for 2009-03-30 18:18 . 2009-03-30 18:21 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\Mp3tag 2009-03-30 10:22 . 2009-03-30 18:52 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\Sony 2009-03-30 10:22 . 2009-03-30 10:22 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Sony 2009-03-30 10:21 . 2009-03-30 18:52 -------- d-----w c:\documents and settings\lukasz\Ustawienia lokalne\Dane aplikacji\Sony 2009-03-30 10:19 . 2009-03-30 10:19 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple 2009-03-29 10:02 . 2009-03-29 10:14 -------- d-----w c:\documents and settings\lukasz\Ustawienia lokalne\Dane aplikacji\Wheelman 2009-03-29 10:02 . 2009-03-29 10:02 -------- d-----w c:\documents and settings\lukasz\Ustawienia lokalne\Dane aplikacji\PC 2009-03-19 17:23 . 2009-04-10 18:26 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\TrackMania 2009-03-19 16:35 . 2009-03-19 16:35 -------- d-----w c:\documents and settings\LocalService\Pulpit 2009-03-18 18:17 . 2009-03-18 18:17 -------- d-----w C:\Games 2009-03-16 21:13 . 2009-04-06 10:08 1355 ----a-w c:\windows\imsins.BAK 2009-03-16 15:05 . 2009-03-16 18:40 475 ----a-w c:\windows\FOE2.ini . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-14 20:02 . 2008-10-10 22:03 -------- d-----w c:\program files\AutoConnect 2009-04-14 20:01 . 2007-10-07 08:41 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\Desktop Sidebar 2009-04-14 19:41 . 2008-10-15 20:46 -------- d-----w c:\program files\Flock 2009-04-14 16:51 . 2007-06-24 18:25 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\uTorrent 2009-04-14 11:17 . 2008-07-03 17:03 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\OpenOffice.org2 2009-04-14 00:15 . 2006-10-12 18:22 -------- d-----w c:\program files\eMule 2009-04-11 19:03 . 2009-04-11 19:03 -------- d-----w c:\program files\1C Publishing EU 2009-04-11 19:03 . 2006-10-12 16:43 -------- d--h--w c:\program files\InstallShield Installation Information 2009-04-10 19:27 . 2001-10-26 14:15 89364 ----a-w c:\windows\system32\perfc015.dat 2009-04-10 19:27 . 2001-10-26 14:15 500378 ----a-w c:\windows\system32\perfh015.dat 2009-04-09 21:55 . 2009-04-09 21:55 -------- d-----w c:\program files\Sports Interactive 2009-04-09 20:41 . 2006-10-12 17:49 23760 -c--a-w c:\documents and settings\lukasz\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-04-09 20:39 . 2008-11-03 22:47 78512 ----a-w c:\documents and settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat 2009-04-08 18:04 . 2009-03-24 21:04 -------- d-----w c:\program files\Ricochet Infinity 2009-04-08 13:00 . 2008-01-31 18:14 -------- d-----w c:\program files\Paint.NET 2009-04-08 10:42 . 2009-03-02 22:34 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Synetic 2009-04-07 22:10 . 2009-01-19 22:54 427 ----a-w C:\m.txt 2009-04-07 10:43 . 2009-04-07 10:43 -------- d-----w c:\program files\GameSpy Arcade 2009-04-07 10:40 . 2009-04-07 10:40 -------- d-----w c:\program files\Aspyr 2009-04-05 19:06 . 2006-10-13 07:13 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\Free Download Manager 2009-04-05 11:21 . 2009-04-05 11:21 -------- d-----w c:\program files\Blade 2009-04-04 21:54 . 2006-10-12 18:08 -------- d-----w c:\program files\Winamp 2009-04-04 21:54 . 2008-03-28 20:28 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\Winamp 2009-04-03 17:32 . 2008-11-18 12:00 -------- d-----w c:\program files\EA Games 2009-04-01 14:55 . 2009-04-01 14:55 -------- d-----w c:\program files\Eidos 2009-04-01 14:06 . 2007-07-03 18:03 22328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2009-04-01 14:06 . 2007-07-27 16:30 103736 ----a-w c:\windows\system32\PnkBstrB.exe 2009-03-31 09:43 . 2007-03-19 09:07 -------- d-----w c:\program files\Common Files\Wise Installation Wizard 2009-03-31 09:43 . 2007-03-19 09:07 -------- d-----w c:\program files\AGEIA Technologies 2009-03-30 18:18 . 2009-03-30 18:18 -------- d-----w c:\program files\Mp3tag 2009-03-30 10:19 . 2009-03-30 10:19 -------- d-----w c:\program files\QuickTime 2009-03-30 10:19 . 2007-06-24 22:15 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2009-03-30 10:19 . 2009-03-30 10:19 -------- d-----w c:\program files\Apple Software Update 2009-03-29 13:50 . 2009-03-27 15:09 -------- d-----w c:\program files\RADVideo 2009-03-29 09:50 . 2009-03-29 09:50 -------- d-----w c:\program files\Ubisoft Entertainment 2009-03-29 09:33 . 2009-01-25 18:00 -------- d-----w c:\program files\America's Army 2009-03-29 09:32 . 2009-01-28 12:28 -------- d-----w c:\program files\Skispringen 2007 2009-03-28 10:45 . 2009-02-23 11:41 -------- d-----w c:\program files\Last.fm 2009-03-27 14:59 . 2009-03-27 14:59 -------- d-----w c:\program files\BreakPoint Software 2009-03-27 10:09 . 2009-03-27 09:51 -------- d-----w c:\program files\Microsoft ActiveSync 2009-03-24 19:32 . 2009-03-24 19:32 -------- d-----w c:\program files\DX-Ball 2009-03-23 15:44 . 2009-03-19 22:27 -------- d-----w c:\program files\Silkroad 2009-03-20 20:15 . 2009-03-20 20:15 -------- d-----w c:\program files\THQ 2009-03-20 01:57 . 2009-03-16 14:47 -------- d-----w c:\program files\EA Sports 2009-03-19 20:23 . 2008-01-30 19:38 -------- d-----w c:\program files\SpeedFan 2009-03-19 17:16 . 2009-03-19 16:27 -------- d-----w c:\program files\Lavasoft 2009-03-19 17:16 . 2009-01-10 21:31 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Lavasoft 2009-03-19 17:15 . 2007-10-26 16:58 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2009-03-19 14:11 . 2009-02-04 10:38 -------- d-----w c:\program files\Electronic Arts 2009-03-19 13:51 . 2007-07-27 16:30 66872 ----a-w c:\windows\system32\PnkBstrA.exe 2009-03-17 14:09 . 2009-03-17 14:09 -------- d-----w c:\program files\UPHClean 2009-03-17 13:57 . 2006-10-12 16:43 -------- d-----w c:\program files\Java 2009-03-17 13:57 . 2008-01-14 22:05 -------- d-----w c:\program files\Ganymede 2009-03-16 20:26 . 2009-03-16 20:24 -------- d-----w c:\program files\TmNationsForever 2009-03-16 11:05 . 2008-10-15 19:29 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\Apple Computer 2009-03-14 21:05 . 2009-03-14 21:05 230752 ----a-w c:\windows\patchw32.dll 2009-03-14 17:51 . 2006-12-04 21:53 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\Skype 2009-03-14 16:08 . 2009-01-27 20:50 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\skypePM 2009-03-09 22:40 . 2006-11-06 15:18 -------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-03-09 22:10 . 2008-04-03 16:46 -------- d-----w c:\program files\CCleaner 2009-03-01 11:13 . 2009-03-01 11:13 -------- d-----w c:\program files\Sierra Entertainment 2009-02-28 18:00 . 2009-02-02 12:57 -------- d-----w c:\program files\Microsoft Games for Windows - LIVE 2009-02-26 13:08 . 2009-02-26 13:08 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\id Software 2009-02-26 13:07 . 2007-11-19 19:28 22328 -c--a-w c:\documents and settings\lukasz\Dane aplikacji\PnkBstrK.sys 2009-02-26 13:07 . 2007-11-19 19:28 2246144 ----a-w c:\windows\system32\pbsvc.exe 2009-02-25 23:39 . 2009-01-15 14:49 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Electronic Arts 2009-02-23 22:53 . 2007-09-21 09:32 -------- d-----w c:\program files\The KMPlayer 2009-02-23 11:42 . 2009-02-23 11:42 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Last.fm 2009-02-19 18:07 . 2008-11-03 14:35 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Sports Interactive 2009-02-19 18:05 . 2006-10-24 17:12 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\Sports Interactive 2009-02-19 14:49 . 2008-10-14 11:27 -------- d-----w c:\documents and settings\lukasz\Dane aplikacji\AIMP 2009-02-02 21:28 . 2009-02-02 23:14 258352 ----a-w c:\windows\system32\unicows.dll 2008-04-17 21:09 . 2008-04-17 21:09 81920 ----a-w c:\documents and settings\lukasz\Dane aplikacji\ezpinst.exe 2008-04-17 21:09 . 2008-04-17 21:09 47360 ----a-w c:\documents and settings\lukasz\Dane aplikacji\pcouffin.sys 2007-04-25 09:17 . 2007-04-25 09:17 131 -c--a-w c:\documents and settings\lukasz\Ustawienia lokalne\Dane aplikacji\fusioncache.dat . ------- Sigcheck ------- [-] 2007-11-04 14:58 359040 C81D6A930A7805F6DAA0C7902B99037E c:\windows\system32\dllcache\tcpip.sys [-] 2007-11-04 14:58 359040 C81D6A930A7805F6DAA0C7902B99037E c:\windows\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((( SnapShot@2009-04-14_19.04.25 ))))))))))))))))))))))))))))))))))))))))) . + 2009-04-14 17:14 . 2009-04-14 20:02 109010 c:\windows\system32\drivers\2a598b0a.sys - 2009-04-14 17:14 . 2009-04-14 19:04 109010 c:\windows\system32\drivers\2a598b0a.sys + 2009-04-14 20:00 . 2005-10-20 18:02 163328 c:\windows\ERDNT\subs\ERDNT.EXE - 2009-04-14 19:01 . 2005-10-20 18:02 163328 c:\windows\ERDNT\subs\ERDNT.EXE . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c}] 2009-04-14 16:51 39424 ----a-w c:\windows\system32\ljJAQGxu.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoConnect"="c:\program files\AutoConnect\AutoConnect.exe" [2006-12-02 310784] "RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616] "SIDEBAR"="c:\program files\Desktop Sidebar\dsidebar.exe" [2006-07-09 1777664] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 57344] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\lukasz\Menu Start\Programy\Autostart\ tclock.lnk - c:\p\tclocklight-040702-3\tclock.exe [2007-12-4 44544] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-7-23 966756] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}"= "c:\windows\system32\ljJAQGxu.dll" [2009-04-14 39424] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljjaqgxu] 2009-04-14 16:51 39424 ----a-w c:\windows\system32\ljJAQGxu.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\[u]0[/u]OODBS [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Exif Launcher.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Exif Launcher.lnk backup=c:\windows\pss\Exif Launcher.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] c:\windows\system32\dumprep 0 -k [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray] 2005-05-19 13:47 57344 -c--a-w c:\program files\SlySoft\CloneCD\CloneCDTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C45 Series] 2004-01-14 01:00 99840 -c--a-w c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I3T1.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2001-07-09 09:50 155648 ----a-w c:\windows\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] 2009-01-15 07:19 13680640 ----a-w c:\windows\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] 2009-01-15 07:19 86016 ----a-w c:\windows\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2007-10-19 18:16 286720 ----a-w c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\REGSHAVE] 2002-02-04 20:32 53248 -c----w c:\program files\REGSHAVE\REGSHAVE.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] 2008-11-18 15:31 21633320 ----a-r c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2008-12-17 20:02 136600 ----a-w c:\program files\Java\jre6\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPP Auto Loader] 2006-04-13 14:28 118784 -c--a-r c:\windows\TPPALDR.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg] 2000-05-10 23:00 90112 -c----w c:\windows\Updreg.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive] 2006-04-29 13:21 94208 -c--a-w c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] 2009-01-15 07:19 1657376 ----a-w c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P17Helper] 2005-05-03 11:38 64512 ----a-r c:\windows\system32\P17.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Tlen.pl\\tlen.exe"= "c:\\Program Files\\Silkroad\\SilkErrSender.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\TVUPlayer\\TVUPlayer.exe"= "c:\\Program Files\\SopCast\\SopCast.exe"= "c:\\Documents and Settings\\lukasz\\Dane aplikacji\\SopCast\\adv\\SopAdver.exe"= "c:\\Program Files\\TVAnts\\Tvants.exe"= "c:\\Program Files\\Aspyr\\MTX\\Game\\MTX.exe"= "c:\\Program Files\\uTorrent\\utorrent.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\Last.fm\\LastFM.exe"= "c:\\WINDOWS\\system32\\dplaysvr.exe"= "c:\\p\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\TmNationsForever\\TmForever.exe"= "c:\\Program Files\\WapSter\\WapSter AQQ\\AQQ.exe"= "c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"= "c:\\Program Files\\Flock\\flock.exe"= "c:\\Program Files\\eMule\\emule.exe"= "c:\\Program Files\\Outspark\\Project Powder\\Run.exe"= "c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutLauncher.exe"= "c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutConfigTool.exe"= "c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutParadise.exe"= "c:\\Program Files\\Java\\jre6\\bin\\java.exe"= "c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic.exe"= "c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_online.exe"= "c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_ds.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\EA Games\\Ojciec chrzestny II\\godfather2.exe"= "c:\\Program Files\\Sports Interactive\\Football Manager 2009\\fm.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8080:TCP"= 8080:TCP:ściąganie "60100:TCP"= 60100:TCP:utorrent port R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 16512] R3 PortTalk;PortTalk;c:\windows\system32\Drivers\PortTalk.sys [2002-01-12 3567] R3 PPJoyBus;Parallel Port Joystick Bus device driver;c:\windows\system32\drivers\PPJoyBus.sys [2003-08-10 11330] R3 PPortJoystick;Parallel Port Joystick device driver;c:\windows\system32\drivers\PPortJoy.sys [2004-10-24 28800] R3 TPPFX;USB Storage Adapter FX (TPP);c:\windows\system32\DRIVERS\TPPFX.SYS [2006-04-13 32256] R4 HDDlife HDD Access service;HDDlife HDD Access service; [x] --- Inne Usługi/Sterowniki w Pamięci --- *Deregistered* - uphcleanhlp . Zawartość folderu 'Zaplanowane zadania' . - - - - USUNIĘTO PUSTE WPISY - - - - BHO-{4651d4c2-7d74-47b5-bc28-a270a43c8eb3} - c:\windows\system32\pmnoNHXq.dll . ------- Skan uzupełniający ------- . IE: Download all with Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm IE: Download selected with Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm IE: Download with Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm IE: Pobierz w Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm IE: Pobierz wszystkie pliki w Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm IE: Pobierz zaznaczone w Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm Trusted Zone: com.pl\mks TCP: {64995ABA-9881-4E1E-ACE7-9C182D1EAF87} = 217.8.168.244 157.25.5.18 DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab FF - ProfilePath - c:\documents and settings\lukasz\Dane aplikacji\Mozilla\Firefox\Profiles\ux1iy719.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - www.wp.pl FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p= ---- FIREFOX - SPOSÓB POSTĘPOWANIA ---- FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: content.max.tokenizing.time - 200000 FF - user.js: content.notify.interval - 100000 FF - user.js: content.switch.threshold - 650000 FF - user.js: nglayout.initialpaint.delay - 300 . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-14 22:02 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\2a598b0a] "ImagePath"="\SystemRoot\System32\drivers\2a598b0a.sys" . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*] "OODEFRAG08.00.00.01WORKSTATION"="095B648FC2CBBC16DC5762DEA70ED780BE4482F18D7D2D8E144AC36C31E4D6F4B01C156D72F1DA74D6E88011456DFE638E5D248BE987E2D44D3AF84C7A2F773BE26F6DB5C8FDBAB245D84CE30C35C9C521777405574641D33F4966BB6E6BEEF93A2A921559D44F937F448F18DAE162CA28978550256EC6329C087FFBE6A8AFF683817FBFAC7C222110AA69EE0A15855A0DA639DF14DA855748670ED3B499C13DC112806C3EA3CDA2B4EFCB325F1205A26970C7AEDB882373DA3EAE8C9915BF9AA85BB7D3FD99842B60DD7F2C1AC2C4110EA9BDB7A4995AF3A0C6D2F3CC1758A0A2411CB5CF50090B3AA09CAD6935405CFD65F9FB8EFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E667A6171C11EC38DE3DA9C6AECB7A5D1407C038D530D6EB3452A34377657AEE3390A9F86740DE80F081D38498D816C980D5DA3D8A265F947B7D3ABC47869B533CB0EE2A7A11CEA4F9A6BE62063AAF14E9A717E039CA50B7F964F0050CA1CA14162850A1694A87D9FC4ECD5C94DE0DE92795AF5F93BF65ADBF3A16592F160D462ADE34CE80A7F7F914CD9CB711FE2607A28499F385DABDB8278D188AE0F54A4CE0322337511A72AD5AEEEE4F0D87D2FECAC9F06E4124DDEE0E648B7C93074E64ADF24A742FC3AAF672712A115C1853B3103073323DDBACB8D7B627267F44CB1D8167793431FB3AA87F8556FE9B864A5F6877043635F0F554E96E49969FDC56575447A6B6B4CF20EAAA51A4AFA35ABC0F4D532B05A48AE7D3B06DEFEA32B2E4CAA2C06AD2D87DBCB99F70E4CD19CF96A1BCE993BECF01189C19863FD93B5DD403EBF381EF847854E3116E0D175FD8A5CE38D60A183C627B6917047FA90125665E33F54C8CDB69928E31D0B75E1F981C1D45A80354B2F0EEC7A19F1C398F8B3E8F004FD0B84D2B83303B0AA20947680FE9ED6215D2C321B097B189257635BF659C607E381C894C98946A062F1208D37B663F7A7C01409D66114766CE67852B46E0DF73CD6D839127DC7EA2E388569C3E164C5D95E13E4294BD64CE7023D8E6B30B9613837CF372E87CBD32E90CEBB69A5429E8648D18A129F810CD07D448C1609E19B76E28D61A7BB9F07810D545CB36CA707011AEEA02717754E431BF33BE6572032DC6E66CE85FB1E2B248AE24361B7CBE3CE5059B5B23BDC08534363F923E2FF5346AC0B771FA54650EA7F48D08B9BDB685CF634EDBD325689976A1CFAA4DD6158359D504FA17E44E2AE71B4A8462377D7B64326C657F5CDFFD85FC14235539864239545981627A7420E8A767264B643DC259EA268D8464C2008FD8F6CF7F7E778ED0838AB4EB03B479AAB4B7971197A3EF891EEC1DA814B1E5E959AFB6D721967910BB2B78AABB70B1D2704D3AAF756111F2EDF5" "OODEFRAG11.00.00.01WORKSTATION"="6A3919A1AA962BE400F5202CA754AB0F68E36AF32D4D5F0FCD6429E84E8CB7C18A25B8D42AD39CEBCF0D4F39420C0F61AE4007C1A34F8E42E5AB2D4EDAF9D6467FA1EA7DC4D8F393C58BB7CEA05A92ACFD261FDDF9D5B5E981D1519B6363328216708D247A42F5A8A0D2D3A2C7CB29B52BB7E743DC819AE0AA5B27B3D69BFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B9808A2D97226D213B555A6171C11EC38DE3DBB0154529664DFDC7F5FFC76AC99FE75D8E4BAC547AF72B3A302B94357042AB6BBF5CEC5569C2CA969064688A2290DD92049094D1F98B95D88060505AA388FC86016789062E7C4F521687810385DA15B830558C1D47385F1C82C56EF4E12452BD37F1CED2C9BCE781D3C14283BF024E168848041B18522AAD4BBF7C4A7801B8938711B5E546FBEEDCC5A2C30A9874F5BA9D86BABB37A3045171FC982CFD7B89021CF69A4B20060160EBE6CCDB6A5B5B694B917A608DFA503E6653FF1944F977596228F474FCED2B3B80B91E84AB338E8EA80169C1628C9AA9641609B7681046D949429126B3E088F16846C2D01818FECE32B0EB8F4A83A84678A47CDACEDA1330AF666937997C7F3E014620B29BE48BC27DABA6D721E675F10BAA29BA0796506DBBD0C9F9D882CB14B456D36470141D956D5686E0EA5950D3D7138DAEDE81927E20072CDB41FA39BF9C91A2791422F4980077AB6FBC1DFE18C72DC25E76A5A5FE9790677CC52F10A07F7899A74DE9814AC7AE60225D830B891A27C59148B9BF6B20C47BC27F7AC587E4671100F195AC55563B8D22735C8ED530F9798AAC0A13E6E39C802BB4E4066E0539BCAB596A36F67180D6CD0063EE4CC653FC91AE00807472A34EB3575E99625DFE354EEE0F8A5C59096D9A85C7981ECF71C1704A63A2959AA46E770703DD2B2CEBCF8F663B102C66C9CE7E42FB6AE173F6A6E3EB2FA7EB22A4E2401A92184662CAA483C71781F336C782773D9865A2255F7825188E0E4D93D3113ADECCF9D12234816E3C0CE204AF798EC75195074587927C8FA0F54C0469B666D71E9D78FFA84C1FB45E88728BD187ED13D114874790E72FBAD1194F6E120FBAD79359DD259C5D753E9E8CADFB2F9C1345546FED2B81AE1990DBE32730F4C1012A8C7D563DB7F613F93A094F344700C34F925540EBC481764742B13A4A043D79E957E8C41A16E46A235D7B39680F19BB79AFAFBA6A1E744E1F1CEF1FCDFCC1C9B8B97206FBFF305A5F436CC79691743E7DCF800A3F36C30DC4583DAF18755B7118839C274BF15AD34B04957D8F31EE7B019383C0D3A6C366264883280C7EB1CD13E6B7DDE9FF9E5FEF5039F6E0B6906C4DB316272E7A1C746F8832B26C445CEEE159B283C4F6FE77989B745FB8C7E" . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(624) c:\windows\system32\ljJAQGxu.dll c:\windows\system32\CLBCATQ.DLL - - - - - - - > 'explorer.exe'(1576) c:\program files\RocketDock\RocketDock.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\nvsvc32.exe c:\windows\system32\PnkBstrA.exe c:\program files\UPHClean\uphclean.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: ~,10time:~,-3machine was rebootedCombobatch-by ComboFix-quarantined-files.txt 2009-04-14 20:05 ComboFix2.txt 2009-04-14 19:08 Przed: 15 836 377 088 bajtów wolnych Po: 15 825 903 616 bajtów wolnych 318

**Posty:** 18165 · przez **wojtas** 14 Kwi 2009, 22:21

Pobierz i uruchom narzędzie
The Avenger
w bialym polu wklej tekst:

Files to delete:

c:\windows\system32\drivers\2a598b0a.sys
c:\windows\system32\vtUmMdBq.dll
c:\windows\system32\ljJAQGxu.dll

Kopiujesz - Klikasz na Paste Script from Clipboard - Execute - Potwierdzasz i zgadzasz się na restart klikając OK.
Po wykonaniu skasuj z dysku plik: C:\Avenger\backup.zip i wklej raport na forum C:\avenger.txt + nowy log z combofixa oraz wykonanaj to jeszcze raz z dodaniem do rejestru bo sie nie dodalo.

**Posty:** 91 · przez **DIIL** 14 Kwi 2009, 22:31

poczekaj bo na innym forum już wiedzą co to za wirus , jeśli oni nic nie zdziałają to zrobie to z tym avenger ...

Dodano 14.04.2009 22:16:48:
ok temat do zamkniecia , tym wirusem był Vundo , temat rozwiązany ...

dzieki chlopie , dalem ci tyle pochwał ile moglem ;]

**Posty:** 18165 · przez **wojtas** 15 Kwi 2009, 12:51

mozna jedną dla jednego usera w danym temacie.