Coś się stało z moją windą, że to nie działa.
Co robić?
Używam Total Commandera, więc jakoś sobie poradzę. Poza tym zawsze można wcisnąć Ctr + X a potem Ctrl + V.
Nie mnie irytuje mnie trochę ten feler.
Okocza napisał(a):z combofixa
ComboFix 08-10-01.06 - Administrator 2008-10-02 19:41:12.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.1.1033.18.1575 [GMT 2:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\lnk3mex.dll
C:\WINDOWS\system32\prsgrc.dll
C:\WINDOWS\system32\ssprs.dll
.
((((((((((((((((((((((((( Files Created from 2008-09-02 to 2008-10-02 )))))))))))))))))))))))))))))))
.
2008-10-02 17:55 . 2008-07-09 05:05 120,568 --------- C:\WINDOWS\system32\pxcpyi64.exe
2008-10-02 17:55 . 2008-07-09 05:05 118,256 --------- C:\WINDOWS\system32\pxinsi64.exe
2008-10-02 17:49 . 2008-10-02 17:49 <DIR> d-------- D:\Programy\Vertus Fluid Mask 3
2008-10-02 17:49 . 2008-10-02 17:49 1,024 --a------ C:\WINDOWS\system32\kqekcdl.tgz
2008-09-21 11:30 . 2008-09-21 11:30 <DIR> d-------- D:\Programy\Microsoft Silverlight
2008-09-18 00:17 . 2008-09-18 00:17 <DIR> d-------- D:\Programy\Depeche Mode
2008-09-18 00:17 . 1998-02-06 22:37 299,520 --a------ C:\WINDOWS\uninst.exe
2008-09-18 00:16 . 2008-09-18 00:16 <DIR> d-------- C:\Documents and Settings\Administrator\WINDOWS
2008-09-14 20:16 . 2008-09-14 20:16 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SPORE
2008-09-11 23:07 . 2008-09-11 23:07 <DIR> d-------- D:\Programy\TacView
2008-09-11 23:07 . 2002-08-09 13:00 4,082,688 --a------ C:\WINDOWS\system32\qtintf70.dll
2008-09-03 19:29 . 2008-09-03 19:29 <DIR> d-------- D:\Programy\gamespeed
2008-09-03 19:29 . 2005-12-07 15:13 57,344 --a------ C:\WINDOWS\system32\HookAPINT.dll
2008-09-03 19:29 . 2005-12-08 10:09 49,152 --a------ C:\WINDOWS\system32\mydll.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-02 17:40 --------- d-----w D:\Programy\cFosSpeed
2008-10-02 17:37 --------- d-----w D:\Programy\AutoConnect
2008-10-02 16:17 --------- d-----w D:\Programy\MagicISO
2008-10-02 15:38 --------- d-----w C:\Documents and Settings\Administrator\Application Data\The Bat!
2008-09-14 18:04 --------- d--h--w D:\Programy\InstallShield Installation Information
2008-09-14 11:42 --------- d-----w D:\Programy\AP Tuner
2008-09-11 22:15 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Skype
2008-09-03 17:33 --------- d-----w D:\Programy\Gadu-Gadu
2008-09-01 19:54 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Sports Interactive
2008-09-01 19:47 --------- d--h--w D:\Programy\Zero G Registry
2008-08-30 11:15 108,548 --sh--w C:\Documents and Settings\Administrator\setupC.exe
2008-08-30 11:15 103,936 --sh--w C:\Documents and Settings\Administrator\sccs.exe
2008-08-28 18:35 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-27 07:58 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Canon
2008-08-25 22:36 --------- d-----w D:\Programy\microsoft frontpage
2008-08-22 17:32 --------- d-----w D:\Programy\ImTOO
2008-08-18 18:51 --------- d-----w C:\Documents and Settings\Administrator\Application Data\ACD Systems
2008-08-18 18:41 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Apple Computer
2008-08-18 18:06 --------- d-----w D:\Programy\Sony Ericsson
2008-08-18 18:06 --------- d-----w D:\Programy\Sony
2008-08-18 18:06 --------- d-----w C:\Program Files\Common Files\Sony Shared
2008-08-18 18:05 --------- d-----w D:\Programy\QuickTime
2008-08-18 18:05 --------- d-----w D:\Programy\Apple Software Update
2008-08-18 18:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-08-18 18:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-08-18 18:00 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Sony Setup
2008-08-18 17:59 --------- d-----w D:\Programy\Sony Setup
2008-08-18 17:51 --------- d-----w D:\Programy\Avanquest update
2008-08-18 17:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\BVRP Software
2008-08-18 17:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sony Ericsson
2008-08-18 17:50 --------- d-----w C:\Documents and Settings\Administrator\Application Data\InstallShield
2008-08-11 22:45 --------- d-----w D:\Programy\Google Earth Pro 4.2
2008-08-10 22:01 --------- d-----w D:\Programy\eMule
2008-08-09 11:34 --------- d-----w D:\Programy\Reference Assemblies
2008-08-09 11:34 --------- d-----w D:\Programy\MSBuild
2008-08-09 11:32 --------- d-----w D:\Programy\MSXML 6.0
2008-08-09 11:15 --------- d-----w C:\Program Files\Common Files\eSellerate
2008-08-06 21:32 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Mount&Blade
2008-08-05 20:38 22,328 ----a-w C:\Documents and Settings\Administrator\Application Data\PnkBstrK.sys
2008-08-05 20:37 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
2008-08-05 20:37 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-08-05 20:37 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-08-05 20:37 103,736 ----a-w C:\Documents and Settings\Administrator\Application Data\PnkBstrB.exe
2008-07-22 21:37 444,952 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-07-22 21:37 109,080 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-07-20 19:50 737,280 ----a-w C:\WINDOWS\iun6002.exe
2008-07-20 15:34 159,924 ----a-w C:\WINDOWS\Marsu-Fix 2.3 Uninstaller.exe
2008-07-19 12:47 155,995 ----a-w C:\WINDOWS\java\Packages\PR37LRZD.ZIP
2008-07-13 18:25 2,040,339 ----a-w C:\WINDOWS\system32\x264vfw.dll
2008-07-09 03:05 129,520 ------w C:\WINDOWS\system32\pxafs.dll
2007-10-07 20:02 51,232 ----a-w D:\Programy\wwdc.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"Gadu-Gadu"="D:\Programy\Gadu-Gadu\gg.exe" [2008-03-20 2127296]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 153136]
"Sony Ericsson PC Suite"="D:\Programy\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-02-20 360448]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 8523776]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 81920]
"egui"="D:\Programy\ESET\ESET Smart Security\egui.exe" [2008-04-23 1443072]
"cFosSpeed"="D:\Programy\cFosSpeed\cFosSpeed.exe" [2008-02-14 863448]
"QuickTime Task"="D:\Programy\QuickTime\qttask.exe" [2008-05-27 413696]
"nwiz"="nwiz.exe" [2007-12-05 C:\WINDOWS\system32\nwiz.exe]
"P17Helper"="P17.dll" [2005-05-03 C:\WINDOWS\system32\P17.dll]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"VIDC.YV12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\Programy\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"D:\\Gry\\Codemasters\\GRID\\GRID.exe"=
"D:\\Gry\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"D:\\Gry\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"D:\\Programy\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"D:\\Gry\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"D:\\Programy\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017
R3 VF0470Vid;Live! Cam Notebook (VF0470);C:\WINDOWS\system32\DRIVERS\V0470Vid.sys [2007-04-20 146368]
S2 EsetNod32Fix;Nod32 AV;C:\WINDOWS\Regedit.exe [2008-04-14 146432]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;D:\Programy\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [2007-04-05 20856]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8f8b0cc3-5834-11dd-84c4-000e50e648d4}]
\Shell\AutoRun\command - H:\autorun.exe
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\atm07j4d.default\
FF -: plugin - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
FF -: plugin - D:\Programy\Adobe\Acrobat 8.0\Acrobat\browser\nppdf32.dll
FF -: plugin - D:\Programy\Java\jre1.5.0_04\bin\NPJava11.dll
FF -: plugin - D:\Programy\Java\jre1.5.0_04\bin\NPJava12.dll
FF -: plugin - D:\Programy\Java\jre1.5.0_04\bin\NPJava13.dll
FF -: plugin - D:\Programy\Java\jre1.5.0_04\bin\NPJava14.dll
FF -: plugin - D:\Programy\Java\jre1.5.0_04\bin\NPJava32.dll
FF -: plugin - D:\Programy\Java\jre1.5.0_04\bin\NPJPI150_04.dll
FF -: plugin - D:\Programy\Java\jre1.5.0_04\bin\NPOJI610.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-02 19:45:05
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\D:\Programy\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"
.
Completion time: 2008-10-02 19:46:45
ComboFix-quarantined-files.txt 2008-10-02 17:46:09
Pre-Run: 15 003 160 576 bytes free
Post-Run: 19,692,982,272 bajtów wolnych
178
Okocza napisał(a):i hijacka
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:48:37, on 2008-10-02
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Programy\Bonjour\mDNSResponder.exe
D:\Programy\cFosSpeed\spd.exe
D:\Programy\ESET\ESET Smart Security\egui.exe
D:\Programy\cFosSpeed\cFosSpeed.exe
D:\Programy\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
D:\Programy\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\tlntsvr.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
D:\Programy\AutoConnect\AutoConnect.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\explorer.exe
D:\Programy\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Programy\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programy\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [egui] "D:\Programy\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [cFosSpeed] D:\Programy\cFosSpeed\cFosSpeed.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programy\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Programy\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "D:\Programy\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Append to existing PDF - res://D:\Programy\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\Programy\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://D:\Programy\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\Programy\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\Programy\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\Programy\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://D:\Programy\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Programy\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\Programy\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programy\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programy\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programy\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programy\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programy\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - D:\Programy\Bonjour\mDNSResponder.exe
O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - D:\Programy\cFosSpeed\spd.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - D:\Programy\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - D:\Programy\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
--
End of file - 6339 bytes
Okocza napisał(a):Okocza
Użytkownicy przeglądający to forum: Brak zarejestrowanych użytkowników oraz 17 gości